What is the CVSS score of CVE-2026-42565?

CVE-2026-42565 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-42565?

Yes, a patch is available for CVE-2026-42565. Update the affected software to the latest version immediately.

AuthKit Session CVE-2026-42565

MEDIUM

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2026-05-05 https://github.com/workos/authkit-session

GHSA-vvvv-983w-r7pv

Authentication Bypass Open Redirect

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 05, 2026 - 19:32 vuln.today

Analysis Generated

May 05, 2026 - 19:32 vuln.today

DescriptionGitHub Advisory

An open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth state parameter.

The state parameter is round-tripped through the identity provider (IdP) and can be influenced by an attacker. The handleCallback function decodes and returns returnPathname without enforcing restrictions on origin or scheme. As a result, attacker-controlled values (e.g., https://evil.com/, //evil.com, or similar variants) may be returned to the application.

If this value is used directly in a redirect (e.g., via an HTTP Location header, framework redirect helpers, or client-side navigation), it may cause the user to be redirected to an external, attacker-controlled site.

Security Impact This issue may be used to facilitate phishing or user redirection attacks by leveraging the trust of the originating domain. For example, an attacker could craft a link that directs a user through a legitimate authentication flow and then redirects them to an external site.

The severity depends on how returnPathname is used by the application. Exploitation requires:

The application to use returnPathname as a redirect target, and
The absence of downstream validation or allowlisting

This vulnerability does not enable authentication bypass, token disclosure, or direct account compromise on its own, but may increase the effectiveness of social engineering attacks when combined with user interaction.

Vulnerability Type CWE-601: URL Redirection to Untrusted Site (Open Redirect)

Patches Patched in https://github.com/workos/authkit-session/releases/tag/v0.5.1

AnalysisAI

Open redirect vulnerability in @workos/authkit-session allows unauthenticated remote attackers to redirect authenticated users to arbitrary external sites by crafting malicious OAuth state parameters. The AuthService.handleCallback function fails to validate the returnPathname value decoded from the state parameter, enabling attackers to embed external URLs (e.g., https://evil.com, //evil.com) that are returned directly in HTTP Location headers or client-side redirects. This facilitates phishing and social engineering attacks by leveraging trust in the legitimate domain. Patched in version 0.5.1.

Technical ContextAI

The vulnerability exists in the OAuth callback handling flow of @workos/authkit-session, an npm package for session management in authentication workflows. The OAuth 2.0 state parameter is a security mechanism designed to prevent CSRF attacks by round-tripping application state through the identity provider (IdP). However, the AuthService.handleCallback function in versions before 0.5.1 decodes the returnPathname value from this state parameter without enforcing origin or URL scheme restrictions. The underlying root cause is CWE-601 (URL Redirection to Untrusted Site), where unsanitized user input is used directly in a redirect context. The fix implements a sanitizeReturnPathname utility function that parses untrusted input against a throwaway origin using the WHATWG URL parser, extracting only the pathname, search, and hash components while discarding any scheme or host. This ensures that only same-origin relative paths (e.g., /dashboard?tab=settings) are returned, while absolute URLs, protocol-relative URLs (//evil.com), scheme-based URLs (javascript:, data:, ftp:), and various smuggling techniques (backslash, null-byte, URL-encoding variants) are neutralized.

RemediationAI

Vendor-released patch: upgrade @workos/authkit-session to version 0.5.1 or later. The patch introduces a sanitizeReturnPathname utility function that normalizes untrusted return-path values by parsing them against a throwaway origin and extracting only the pathname, search, and hash components, neutralizing absolute URLs, protocol-relative URLs, and various URL-encoding and scheme smuggling techniques. Update your package.json dependency and run npm install or equivalent package manager update. If upgrading is not immediately possible, implement a downstream allowlist of permitted redirect destinations before using returnPathname in any redirect operation-explicitly validate that returnPathname begins with a single forward slash and does not contain any scheme or domain components. However, relying solely on allowlisting introduces maintenance risk if paths are added without proper security review, so patching should be prioritized. The patch has been verified via the GitHub commit f56e1d6214a93160759e5677b7a3d772b244db39, which also adds comprehensive unit tests covering absolute URLs, protocol-relative URLs, backslash smuggling, scheme-based attacks, and character-based smuggling (null-byte, URL-encoding variants).