Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
feathersjs/feathers
dove @ 6cb3859
65
Fixes
6
CVEs
CRITICAL
Peak severity
58.8%
Coverage
Highlights
Auth Bypass: 29 prior fixes. Scrutinize any change in this area.
packages/authentication-oauth/src/strategy.ts: most-fixed (5 issues). Treat as high-risk during review.
37 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The OAuth callback endpoint was vulnerable to falling back to raw query parameters when no valid provider response was present, allowing unauthenticated attackers to obtain valid access tokens and fully bypass authentication. This is captured in CVE-2026-29792.
NoSQL Injection: A lack of strict type validation on the query 'id' argument inside MongoDB adapter queries allowed attackers to inject arbitrary parameters and execute unauthorized database manipulations via WebSocket messages (CVE-2026-29793).
Open Redirect: The OAuth redirect configuration was vulnerable to domain suffix attacks and authority injection. The vulnerability was caused by insufficient path checks that failed to guarantee redirects only targeted relative paths or validly configured origins.