CVE-2026-42565

{
  "id": "CVE-2026-42565",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-11T20:25:42.640",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "@workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations. Prior to 0.5.1, an open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth state parameter. The state parameter is round-tripped through the identity provider (IdP) and can be influenced by an attacker. The handleCallback function decodes and returns returnPathname without enforcing restrictions on origin or scheme. As a result, attacker-controlled values may be returned to the application. If this value is used directly in a redirect, it may cause the user to be redirected to an external, attacker-controlled site. This vulnerability is fixed in 0.5.1."
    },
    {
      "lang": "es",
      "value": "@workos/authkit-session es un conjunto de herramientas para construir integraciones del framework WorkOS AuthKit. Antes de la versión 0.5.1, existe una vulnerabilidad de redirección abierta en AuthService.handleCallback debido a una validación insuficiente del valor returnPathname derivado del parámetro de estado de OAuth. El parámetro de estado se envía de ida y vuelta a través del proveedor de identidad (IdP) y puede ser influenciado por un atacante. La función handleCallback decodifica y devuelve returnPathname sin aplicar restricciones en el origen o el esquema. Como resultado, los valores controlados por el atacante pueden ser devueltos a la aplicación. Si este valor se utiliza directamente en una redirección, puede hacer que el usuario sea redirigido a un sitio externo controlado por el atacante. Esta vulnerabilidad está corregida en la versión 0.5.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "workos",
          "product": "authkit-session",
          "versions": [
            {
              "version": "< 0.5.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-12T16:30:19.568319Z",
          "id": "CVE-2026-42565",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/workos/authkit-session/commit/f56e1d6214a93160759e5677b7a3d772b244db39",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/workos/authkit-session/releases/tag/v0.5.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/workos/authkit-session/security/advisories/GHSA-vvvv-983w-r7pv",
      "source": "[email protected]"
    }
  ]
}