Feathersjs versions 5.0.39 and earlier validate request origins by checking whether the Referer header starts with any allowed origin, using startsWith. This prefix-only comparison allows an attacker to register a domain that shares a common prefix with an authorized origin (for example, https://target.com.attacker.com matches https://target.com). The flaw can be exploited when the origins array is configured, enabling an unauthorized origin to initiate the OAuth flow and exfiltrate tokens. On a successful attack, the attacker can achieve full account takeover. The weakness corresponds to improper origin validation (CWE-346).

The affected product is the Feathersframework (feathersjs:feathers) running on Node.js. All releases up to and including version 5.0.39 are vulnerable; the defect was fixed in release 5.0.40.

The vulnerability scores a 7.6 on the CVSS base list, indicating high severity, while the EPSS score is less than 1 % suggesting a low probability of exploitation at this time. It is not listed in the CISA KEV catalog. Attackers would need to control or register a domain that shares a common prefix with an allowed origin, and the target application must be configured to use OAuth with a permissive origins list. Because the flaw directly impacts the integrity of OAuth token handling, organizations should regard the risk as significant even though the exploitation likelihood remains very low.