Skip to content
OpenAdvisories

Product · workos

authkit-session

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 4.3
    CVE-2026-42565

    @workos/authkit-session: Open Redirect via state-derived redirect target

    @workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations. Prior to 0.5.1, an open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth stat…

    workos authkit-session @workos/authkit-session npm