HIGHnpm
GHSA-9m9c-vpv5-9g85· CVE-2026-27193Feathers exposes internal headers via unencrypted session cookie
Modified: 2/23/2026
package
npm/@feathersjs/authentication-oauth
pkg:npm/%40feathersjs/authentication-oauth
HIGHnpm
GHSA-mp4x-c34x-wv3x· CVE-2026-27192Feathers has an origin validation bypass via prefix matching
Modified: 2/23/2026
HIGHnpm
GHSA-ppf9-4ffw-hh4p· CVE-2026-27191Feathers has an open redirect in OAuth callback enables account takeover
Modified: 2/23/2026
CRITICALnpm
GHSA-wg9x-qfgw-pxhj· CVE-2026-29792Feathers has an OAuth Callback Account Takeover issue
Modified: 3/13/2026