CVE-2026-27191: Verified Repro With Script Download

Q: How severe is CVE-2026-27191?

High severity. An open redirect in the OAuth callback flow can be used to enable account takeover.

Q: How can I reproduce CVE-2026-27191?

Download the verified script from this page and run it in an isolated environment against @feathersjs/authentication-oauth <= 5.0.39. Initiate the OAuth callback flow with a crafted redirect containing an injected URL authority and confirm the application redirects to the attacker-controlled origin instead of the legitimate one; confirm 5.0.40 rejects the injected authority.

Pruva

CVE-2026-27191: Verified Repro With Script Download

CVE-2026-27191: Feathers OAuth Open Redirect Account Takeover

Download script Open in Codespaces

CVE-2026-27191 is verified against @feathersjs/authentication-oauth · npm. Affected versions: <= 5.0.39. Fixed in 5.0.40. Vulnerability class: Open Redirect. This medium reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00109.

REPRO-2026-00109 @feathersjs/authentication-oauth · npm Open Redirect Feb 20, 2026 CVE entry ↗ .txt

Severity

MEDIUM

CVSS

6.1

Reproduced in

12m 54s

Tool calls

78

Spend

$0.31

01 · Overview

What Is CVE-2026-27191?

CVE-2026-27191 is a high-severity open redirect (CWE-601) in @feathersjs/authentication-oauth's OAuth callback handling that can be leveraged for account takeover via URL authority injection. Pruva reproduced it (reproduction REPRO-2026-00109).

02 · Severity & CVSS

CVE-2026-27191 Severity & CVSS Score

CVE-2026-27191 is rated medium severity, with a CVSS base score of 6.1 out of 10.

MEDIUM threat level

6.1 / 10 CVSS base

Weakness CWE-601 — URL Redirection to Untrusted Site ('Open Redirect')

Medium — meaningful risk under specific conditions. Schedule a fix in the normal cycle.

03 · Affected Versions

Affected @feathersjs/authentication-oauth Versions

@feathersjs/authentication-oauth · npm versions <= 5.0.39 are affected.

05 · How to Reproduce

Download script Open in Codespaces →

$ pruva-verify REPRO-2026-00109

or

curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00109/artifacts/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh

Run in a VM or disposable container. This exploits a real vulnerability.

06 · Proof of Reproduction

Proof of Reproduction for CVE-2026-27191

Reproduced by Pruva's autonomous agents — 78 tool calls over 13 min. Full root-cause analysis and the complete transcript are below.

How the agent worked 223 events · 78 tool calls · 13 min

13 minDuration

78Tool calls

47Reasoning steps

223Events

Agent activity over 13 min

Support

24

Repro

88

Variant

107

0:0012:54

Root Cause and Exploit Chain for CVE-2026-27191

Open redirect in OAuth callback enables account takeover via URL authority injection

CVE-2026-27191 Reproduction Transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.

Full session Replay every step — scrub the timeline or play it back.

Event 1/40

0:00

support

repro

2:25

0:00

session startedaccounts/fireworks/models/kimi-k2p5 · ghsa-ppf9-4ffw-hh4p · ghsa-ppf

0:03

0:16

0:30

0:35

web search

0:54

0:57

web search

1:04

1:08

1:25

extract_facts

no facts extracted

1:32

supportrepro

2:13

2:19

2:22

2:25

Artifacts and Evidence for CVE-2026-27191

Scripts, logs, diffs, and output captured during the reproduction.

No artifacts available

08 · How to Fix

How to Fix CVE-2026-27191

Upgrade @feathersjs/authentication-oauth · npm to 5.0.40 or later.

Coming soon

Step-by-step mitigation and hardening guidance for CVE-2026-27191 — configuration checks, workarounds where no patch exists, and how to verify you're protected — is on the way.

10 · FAQ

FAQ: CVE-2026-27191

Which versions of @feathersjs/authentication-oauth are affected by CVE-2026-27191, and where is it fixed?

@feathersjs/authentication-oauth <= 5.0.39 is affected. It is fixed in 5.0.40.

How severe is CVE-2026-27191?