A flaw in FeathersJS allows an attacker to manipulate the OAuth callback redirect URL, causing the application to construct a redirect that injects a malicious host. By including a value such as @attacker.com in the redirect parameter, the browser interprets the request as going to attacker.com while preserving the access token in the fragment. The attacker can then capture the victim’s access token, which enables full impersonation of the user. The weakness is identified as CWE‑601 – Open Redirect.

Applications built with FeathersJS version 5.0.39 or earlier are affected. The bug appears when the "origins" array in the Feathers configuration is used and the origin values lack a trailing slash, allowing the redirect concatenation to form a URL with the attacker’s host. The fix is included in version 5.0.40.

The vulnerability carries a CVSS score of 7.4, indicating high potential for exploitation. The EPSS score is below 1%, suggesting low current exploitation probability, and the issue is not listed in the CISA KEV catalog. The attack vector is likely an unauthenticated request to an OAuth endpoint that accepts an attacker‑controlled redirect parameter. Users may be tricked into visiting a crafted link, enabling the attacker to steal tokens and gain full account access. No public exploits are known, but the combination of a high CVSS score and the nature of OAuth makes this a priority for remediation.