CVE-2026-29792

CVE-2026-29792 is a critical vulnerability affecting Feathersjs versions 5.0.0 through 5.0.41, where an unauthenticated attacker can forge an OAuth profile to obtain a valid access token for any existing user. Rated 9.8 CRITICAL, this flaw allows a remote attacker to bypass OAuth authentication with low complexity and no user interaction by sending a crafted GET request to the callback endpoint. Successful exploitation grants the attacker full control over the targeted user's account, leading to complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation, public exploit code, or significant community discussion, organizations using affected Feathersjs versions should upgrade to 5.0.42 immediately to mitigate this risk.