PT-2026-37271 · Npm · @Workos/Authkit-Session

Kenkunz · Published 2026-05-05 · Updated 2026-05-11 · CVE-2026-42565

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions @workos/authkit-session versions prior to 0.5.1

Description An open redirect issue exists in the handleCallback() function of AuthService due to insufficient validation of the returnPathname value derived from the OAuth state parameter. The state parameter is round-tripped through the identity provider (IdP) and can be influenced by an attacker. The handleCallback() function decodes and returns returnPathname without enforcing restrictions on origin or scheme, allowing attacker-controlled values to be returned to the application. If this value is used directly in a redirect, users may be sent to an external, attacker-controlled site, which can facilitate phishing or social engineering attacks by leveraging the trust of the originating domain.

Recommendations Update to version 0.5.1.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-42565

GHSA-VVVV-983W-R7PV

Affected Products

@Workos/Authkit-Session

References · 6

• https://osv.dev/vulnerability/GHSA-vvvv-983w-r7pv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42565 · Security Note
• https://github.com/workos/authkit-session/commit/f56e1d6214a93160759e5677b7a3d772b244db39 · Note
• https://github.com/workos/authkit-session · Note
• https://github.com/workos/authkit-session/releases/tag/v0.5.1 · Note
• https://github.com/workos/authkit-session/security/advisories/GHSA-vvvv-983w-r7pv · Note