CVE-2026-29792

The attacker sends a crafted GET request directly to the /oauth/:provider/callback endpoint, placing a forged user profile in the query string. Since the attacker never initiated a proper OAuth flow, the Grant library has no session or state data, triggering a fallback mechanism in the authentication payload processing chain. The fallback accesses raw request parameters (params.query), where the attacker placed the forged profile. Based on this data, the system retrieves the user entity and generates a JWT token—without any contact with the actual OAuth provider.

An unauthenticated attacker obtains a valid JWT access token assigned to an existing user account, enabling complete impersonation of that person and access to all resources protected by that token.

Update Feathers.js to version 5.0.42 as soon as possible, where the vulnerability has been removed. Until the patch is deployed, consider temporarily blocking access to the /oauth/:provider/callback endpoints at the firewall or reverse proxy level.

Feathersjs Feathers in versions 5.0.0 to 5.0.41 (before 5.0.42)