CVE-2026-42565 describes an open redirect vulnerability in the workos authkit-session package before version 0.5.1. The vulnerability occurs in the AuthService.handleCallback method, which decodes and returns a returnPathname value derived from the OAuth state parameter without validating its origin or scheme. Since the state parameter is passed through the identity provider and can be influenced by an attacker, this lack of validation can lead to redirecting users to malicious external URLs. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity) and does not impact confidentiality or availability but can lead to limited integrity impact through redirection. The issue is resolved in version 0.5.1.

The vulnerability allows an attacker to craft a malicious OAuth state parameter that causes the application to redirect users to an attacker-controlled external site. This can facilitate phishing or other social engineering attacks by misleading users. There is no direct impact on confidentiality or availability. The integrity impact is limited to the potential misuse of redirection.

Upgrade workos authkit-session to version 0.5.1 or later, where this open redirect vulnerability is fixed. Since this is a client-side library, applying the official update is the recommended remediation. Patch status is confirmed by the vendor stating the issue is fixed in 0.5.1.