npmPackage

@feathersjs/authentication-oauth

4 known vulnerabilities (1 critical, 3 high), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-29792Critical 9.3
Feathersjs has an OAuth Callback Account Takeover
Affected: from 5.0.0, fixed in 5.0.42.
Fixed in 5.0.42 (released Mar 4, 2026, 6 days before disclosure).
The latest release, 5.0.52, is not affected.
15% of @feathersjs/authentication-oauth downloads last week were affected versions (5.9K).
CVE-2026-27193High 8.2
Feathers exposes internal headers via unencrypted session cookie
Affected: fixed in 5.0.40.
Fixed in 5.0.40 (released Feb 3, 2026, 18 days before disclosure).
The latest release, 5.0.52, is not affected.
31% of @feathersjs/authentication-oauth downloads last week were affected versions (12.3K).
CVE-2026-27192High 7.6
Feathers has an origin validation bypass via prefix matching
Affected: fixed in 5.0.40.
Fixed in 5.0.40 (released Feb 3, 2026, 18 days before disclosure).
The latest release, 5.0.52, is not affected.
31% of @feathersjs/authentication-oauth downloads last week were affected versions (12.3K).
CVE-2026-27191High 7.4
Feathers: Open Redirect in OAuth callback enables account takeover
Affected: fixed in 5.0.40.
Fixed in 5.0.40 (released Feb 3, 2026, 18 days before disclosure).
The latest release, 5.0.52, is not affected.
31% of @feathersjs/authentication-oauth downloads last week were affected versions (12.3K).