Feathersjs has an OAuth Callback Account Takeover

Vulnerability

Overview

CVE-2026-29792 is an authentication bypass vulnerability in Feathersjs versions 5.0.0 through 5.0.41. The OAuth service's authentication payload contains a fallback chain that, when Grant's session/state responses are empty, reaches params.query — the raw request query string. An attacker who never initiates an OAuth authorize flow can send a crafted GET request directly to /oauth/:provider/callback with a forged profile in the query string. Since Grant has no session to work with, it produces no response, causing the fallback to fire and use the attacker-supplied profile [1][3].

Exploitation

No authentication is required. The attacker only needs network access to the target Feathersjs application. By crafting a GET request to the OAuth callback endpoint with a query string containing a forged profile (e.g., ?profile=%7B%22id%22%3A%22...%22%7D), the fallback logic processes this fake profile as if it came from a legitimate OAuth provider. The forged profile then drives entity lookup and JWT minting [1][3].

Impact

Successful exploitation yields a valid access token for an existing user without ever contacting the OAuth provider. This effectively allows an unauthenticated attacker to impersonate any user whose identifier can be guessed or enumerated, leading to full account takeover. The CVSS 4.0 score is 9.8 (Critical) [1][3].

Mitigation

The vulnerability is fixed in Feathersjs version 5.0.42. Users running versions 5.0.0 through 5.0.41 should upgrade immediately. No workarounds have been published [1][3].