@workos/authkit-session has an Open Redirect via state-derived redirect target

Description

An open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth state parameter.

The state parameter is round-tripped through the identity provider (IdP) and can be influenced by an attacker.

Recommendation

Update the @workos/authkit-session package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.5.1
• Patched version(s): 0.5.1

References

• GHSA-vvvv-983w-r7pv
• CVE-2026-42565
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Waku has an Open Redirect via `unstable_redirect` Helper - CVE-2026-49456
• Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules - CVE-2026-44372
• Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules - nitro - CVE-2026-44372
• Feathers has an open redirect in OAuth callback enables account takeover - CVE-2026-27191

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@workos/authkit-session