An unauthenticated attacker can craft a GET request to the /oauth/:provider/callback endpoint with a forged profile in the query string. Because the OAuth service uses a fallback chain that reaches the raw request query when the session information is absent, the forged profile can drive entity lookup and cause the framework to issue a valid JSON Web Token. This results in an attacker obtaining a legitimate access token for an existing user without ever contacting the OAuth provider. The weakness is an Authentication Bypass, described by CWE-287.

The vulnerability affects Feathersjs authentication-oauth and feathers framework versions from 5.0.0 up to but not including 5.0.42. Users of these packages running a web API or real-time application that exposes the /oauth/:provider/callback route are potentially impacted.

The CVSS score of 9.3 indicates a critical severity, while the EPSS score of under 1% reflects a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is a remote HTTP request, requiring no prior authentication or interaction with the OAuth provider, and can be triggered simply by visiting the crafted callback URL.