CVE-2026-29792: Feathersjs OAuth Auth Bypass Vulnerability

CVE-2026-29792 Overview

CVE-2026-29792 is an authentication bypass vulnerability in FeathersJS, a popular framework for creating web APIs and real-time applications with TypeScript or JavaScript. The flaw exists in versions 5.0.0 to before 5.0.42 and allows an unauthenticated attacker to obtain valid access tokens for existing users without completing the OAuth authentication flow.

The vulnerability stems from improper authentication handling in the OAuth callback endpoint. An attacker can send a crafted GET request directly to /oauth/:provider/callback with a forged profile in the query string. Because the OAuth service's authentication payload uses a fallback chain that reaches params.query when Grant's session/state responses are empty, the forged profile drives entity lookup and JWT minting, effectively bypassing authentication entirely.

Critical Impact

Unauthenticated attackers can impersonate any existing user and obtain valid JWT access tokens without ever contacting the OAuth provider, leading to complete authentication bypass.

Affected Products

• FeathersJS versions 5.0.0 through 5.0.41
• Applications using FeathersJS OAuth authentication with any OAuth provider

Discovery Timeline

• 2026-03-10 - CVE CVE-2026-29792 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-29792

Vulnerability Analysis

This vulnerability is classified as CWE-287 (Improper Authentication) and represents a significant design flaw in how FeathersJS handles OAuth callback requests. The root issue lies in the fallback mechanism used when processing OAuth authentication payloads.

Under normal OAuth flow, a user initiates authentication through an authorize endpoint, which creates a session with the OAuth provider. Upon successful authentication, the provider redirects back to the callback endpoint with session state that the application uses to verify and complete authentication.

However, in vulnerable FeathersJS versions, when an attacker directly accesses the callback endpoint without initiating a proper OAuth flow, Grant's session/state responses are empty. The authentication service then falls back through a chain that ultimately reaches params.query—the raw request query string. This allows an attacker to inject a forged user profile directly via query parameters.

Root Cause

The root cause is the unsafe fallback chain in the OAuth service's authentication payload processing. When Grant produces no response due to the absence of a valid OAuth session, the code falls back to reading user profile data from params.query. This design assumes that query parameters can only contain legitimate OAuth provider responses, which is a flawed assumption since attackers can directly craft requests to the callback endpoint.

Attack Vector

The attack requires network access to the vulnerable FeathersJS application. An attacker can exploit this vulnerability by:

1. Identifying a FeathersJS application using OAuth authentication (versions 5.0.0 to 5.0.41)
2. Crafting a GET request to /oauth/:provider/callback with forged profile data in the query string
3. The forged profile should contain identifying information (such as email) matching an existing user
4. The application processes the forged profile, looks up the matching user entity, and mints a valid JWT
5. The attacker receives a valid access token and can impersonate the targeted user

The attack does not require any prior authentication, user interaction, or contact with the actual OAuth provider, making it particularly dangerous for applications with public-facing OAuth endpoints.

Detection Methods for CVE-2026-29792

Indicators of Compromise

• Unusual GET requests to /oauth/:provider/callback endpoints that lack proper OAuth state parameters
• JWT tokens issued without corresponding OAuth authorization requests in logs
• Authentication events where OAuth provider callback lacks session correlation
• Multiple authentication attempts from the same IP targeting different user accounts via the callback endpoint

Detection Strategies

• Monitor for direct requests to OAuth callback endpoints that bypass the authorize flow
• Implement logging to correlate OAuth authorize requests with their corresponding callbacks
• Alert on OAuth callback requests missing expected state or session parameters
• Review access logs for patterns of callback requests without prior authorize requests from the same session

Monitoring Recommendations

• Deploy web application firewalls (WAF) with rules to detect OAuth callback requests with suspicious query parameters
• Implement rate limiting on OAuth callback endpoints to slow down enumeration attempts
• Enable detailed logging of OAuth authentication flows including request origins and parameter contents
• Set up alerts for authentication events that lack expected OAuth provider verification steps

How to Mitigate CVE-2026-29792

Immediate Actions Required

• Upgrade FeathersJS to version 5.0.42 or later immediately
• Audit authentication logs for signs of exploitation prior to patching
• Review and rotate credentials for any accounts that may have been compromised
• Consider temporarily disabling OAuth authentication if immediate patching is not possible

Patch Information

The vulnerability is fixed in FeathersJS version 5.0.42. The fix addresses the unsafe fallback chain by ensuring that user profile data cannot be sourced from raw query parameters when OAuth session state is missing. Organizations should update their FeathersJS dependency to 5.0.42 or later.

For detailed information about the fix, refer to the GitHub Security Advisory.

Workarounds

• Implement network-level restrictions to limit access to OAuth callback endpoints from trusted sources only
• Add middleware to validate that OAuth callback requests include valid session state before processing
• Configure OAuth providers to use strict redirect URI validation to limit callback abuse
• Monitor and block requests to callback endpoints that lack proper OAuth flow correlation

# Update FeathersJS to the patched version
npm update @feathersjs/feathers@5.0.42

# Or update in package.json and reinstall
npm install @feathersjs/feathers@^5.0.42