CVE-2026-42565

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42565", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-28T17:26:12.084Z", "datePublished": "2026-05-11T19:01:28.340Z", "dateUpdated": "2026-05-12T16:30:33.422Z"}, "containers": {"cna": {"title": "@workos/authkit-session: Open Redirect via state-derived redirect target", "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/workos/authkit-session/security/advisories/GHSA-vvvv-983w-r7pv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/workos/authkit-session/security/advisories/GHSA-vvvv-983w-r7pv"}, {"name": "https://github.com/workos/authkit-session/commit/f56e1d6214a93160759e5677b7a3d772b244db39", "tags": ["x_refsource_MISC"], "url": "https://github.com/workos/authkit-session/commit/f56e1d6214a93160759e5677b7a3d772b244db39"}, {"name": "https://github.com/workos/authkit-session/releases/tag/v0.5.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/workos/authkit-session/releases/tag/v0.5.1"}], "affected": [{"vendor": "workos", "product": "authkit-session", "versions": [{"version": "< 0.5.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-11T19:01:28.340Z"}, "descriptions": [{"lang": "en", "value": "@workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations. Prior to 0.5.1, an open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth state parameter. The state parameter is round-tripped through the identity provider (IdP) and can be influenced by an attacker. The handleCallback function decodes and returns returnPathname without enforcing restrictions on origin or scheme. As a result, attacker-controlled values may be returned to the application. If this value is used directly in a redirect, it may cause the user to be redirected to an external, attacker-controlled site. This vulnerability is fixed in 0.5.1."}], "source": {"advisory": "GHSA-vvvv-983w-r7pv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-12T16:30:19.568319Z", "id": "CVE-2026-42565", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-12T16:30:33.422Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42565", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-12T16:30:19.568319Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-12T16:30:28.604Z"}}], "cna": {"title": "@workos/authkit-session: Open Redirect via state-derived redirect target", "source": {"advisory": "GHSA-vvvv-983w-r7pv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "workos", "product": "authkit-session", "versions": [{"status": "affected", "version": "< 0.5.1"}]}], "references": [{"url": "https://github.com/workos/authkit-session/security/advisories/GHSA-vvvv-983w-r7pv", "name": "https://github.com/workos/authkit-session/security/advisories/GHSA-vvvv-983w-r7pv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/workos/authkit-session/commit/f56e1d6214a93160759e5677b7a3d772b244db39", "name": "https://github.com/workos/authkit-session/commit/f56e1d6214a93160759e5677b7a3d772b244db39", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/workos/authkit-session/releases/tag/v0.5.1", "name": "https://github.com/workos/authkit-session/releases/tag/v0.5.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "@workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations. Prior to 0.5.1, an open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth state parameter. The state parameter is round-tripped through the identity provider (IdP) and can be influenced by an attacker. The handleCallback function decodes and returns returnPathname without enforcing restrictions on origin or scheme. As a result, attacker-controlled values may be returned to the application. If this value is used directly in a redirect, it may cause the user to be redirected to an external, attacker-controlled site. This vulnerability is fixed in 0.5.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-11T19:01:28.340Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42565", "state": "PUBLISHED", "dateUpdated": "2026-05-12T16:30:33.422Z", "dateReserved": "2026-04-28T17:26:12.084Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-11T19:01:28.340Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "authkit-session", "vendor": "workos", "versions": [{"status": "affected", "version": "< 0.5.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "@workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations. Prior to 0.5.1, an open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth state parameter. The state parameter is round-tripped through the identity provider (IdP) and can be influenced by an attacker. The handleCallback function decodes and returns returnPathname without enforcing restrictions on origin or scheme. As a result, attacker-controlled values may be returned to the application. If this value is used directly in a redirect, it may cause the user to be redirected to an external, attacker-controlled site. This vulnerability is fixed in 0.5.1."}, {"lang": "es", "value": "@workos/authkit-session es un conjunto de herramientas para construir integraciones del framework WorkOS AuthKit. Antes de la versi\u00f3n 0.5.1, existe una vulnerabilidad de redirecci\u00f3n abierta en AuthService.handleCallback debido a una validaci\u00f3n insuficiente del valor returnPathname derivado del par\u00e1metro de estado de OAuth. El par\u00e1metro de estado se env\u00eda de ida y vuelta a trav\u00e9s del proveedor de identidad (IdP) y puede ser influenciado por un atacante. La funci\u00f3n handleCallback decodifica y devuelve returnPathname sin aplicar restricciones en el origen o el esquema. Como resultado, los valores controlados por el atacante pueden ser devueltos a la aplicaci\u00f3n. Si este valor se utiliza directamente en una redirecci\u00f3n, puede hacer que el usuario sea redirigido a un sitio externo controlado por el atacante. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.5.1."}], "id": "CVE-2026-42565", "lastModified": "2026-10-26T18:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42565", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-12T16:30:19.568319Z", "version": "2.0.3"}}]}, "published": "2026-05-11T20:25:42.640", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/workos/authkit-session/commit/f56e1d6214a93160759e5677b7a3d772b244db39"}, {"source": "security-advisories@github.com", "url": "https://github.com/workos/authkit-session/releases/tag/v0.5.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/workos/authkit-session/security/advisories/GHSA-vvvv-983w-r7pv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.5.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "authkit-session", "source": "cna", "vendor": "workos"}, "product": "authkit-session", "vendor": "workos"}], "created": "2026-05-11T21:00:14.486431+00:00", "updated": "2026-05-12T09:22:28.151794+00:00", "vendors": ["workos", "workos$PRODUCT$authkit-session"]}