[@feathersjs/authentication-oauth] Feathers has an origin validation bypass via prefix matching

**[@feathersjs/authentication-oauth] Feathers has an origin validation bypass via prefix matching**

The origin validation uses startsWith() for comparison, allowing attackers to bypass the check by registering a domain that shares a common prefix with an allowed origin. The getAllowedOrigin() function checks if the Referer header starts with any allowed origin: // https://github.com/feathersjs/feathers/blob/dove/packages/authentication-oauth/src/strategy.ts#L75 const allowedOrigin = origins.find((current) => referer.toLowerCase().startsWith(current.toLowerCase())); This comparison is insufficient as it only validates the prefix. This is exploitable when the origins array is configured and an attacker registers a domain starting with an allowed origin string (e.g., https://target.com.attacker.com bypasses https://target.com). On its own, tokens are still redirected to a configured origin. However, in specific scenarios an attacker can initiate the OAuth flow from an unauthorized origin and exfiltrate tokens, achieving full account takeover...

---

**[devsupporter 해설]**

이 기사는 GitHub Security Advisories에서 제공하는 최신 개발 동향입니다. 관련 도구나 기술에 대해 더 알아보시려면 원본 링크를 참고하세요.