Auth bypass in @Feathersjs Authentication-Oauth
CVE-2026-29792
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. From 5.0.0 to before 5.0.42, an unauthenticated attacker can send a crafted GET request directly to /oauth/:provider/callback with a forged profile in the query string. The OAuth service's authentication payload has a fallback chain that reaches params.query (the raw request query) when Grant's session/state responses are empty. Since the attacker never initiated an OAuth authorize flow, Grant has no session to work with and produces no response, so the fallback fires. The forged profile then drives entity lookup and JWT minting. The attacker gets a valid access token for an existing user without ever contacting the OAuth provider. This vulnerability is fixed in 5.0.42.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.006 (48.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 48th percentile — 48.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.006 · change: +0.001
Affected products
- @Feathersjs Authentication-Oauth — versions >= 5.0.0, < 5.0.42
- Feathersjs Feathers — versions >= 5.0.0, < 5.0.42
Weakness classification (CWE)
References
- github.com/feathersjs/feathers/security/advisories/GHSA-wg9x-qfgw-pxhj (Vendor Advisory)
Frequently asked questions
- What is CVE-2026-29792?
- CVE-2026-29792 is a critical-severity vulnerability in @Feathersjs Authentication-Oauth, classified under Improper Authentication. CVSS score: 9.8/10. Published 2026-03-10.
- How severe is CVE-2026-29792?
- Critical severity. CVSS v3 base score is 9.8 out of 10.