workos authkit-session vulnerabilities

Latest workos authkit-session CVEs

Newest publication first

1. CVE-2026-42565 @workos/authkit-session: Open Redirect via state-derived redirect target

   Published 2026-05-11

   Medium·CVSS 4.3 EPSS 0.19%

   @workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations. Prior to 0.5.1, an open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth state parameter. The stat...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.