CVE-2026-27192

CVE-2026-27192 is a critical vulnerability affecting Feathersjs versions 5.0.39 and below, where insufficient origin validation allows attackers to bypass security checks. The vulnerability stems from the use of startsWith() for origin comparison, enabling attackers to register domains that share a common prefix with allowed origins. This high-severity flaw (CVSS 8.1) can lead to full account takeover through OAuth token exfiltration in specific scenarios. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.