The workos authkit-session toolkit before version 0.5.1 contains an open redirect vulnerability (CWE-601) in the AuthService.handleCallback function. The function decodes and returns a returnPathname value derived from the OAuth state parameter without enforcing origin or scheme restrictions. Since the state parameter is round-tripped through the identity provider and can be attacker-controlled, this allows an attacker to manipulate the redirect destination, potentially redirecting users to malicious external sites. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity) and does not impact confidentiality or availability but can cause limited integrity impact. The issue is resolved in version 0.5.1.

This vulnerability can lead to users being redirected to attacker-controlled external websites if the vulnerable returnPathname value is used directly in redirects. This may facilitate phishing or other social engineering attacks by misleading users about the destination of a redirect. There is no direct impact on confidentiality or availability. No known exploits are reported in the wild.

Upgrade workos authkit-session to version 0.5.1 or later, where the open redirect vulnerability is fixed. Since the vendor has released a fixed version, applying this official update is the recommended remediation. Patch status is confirmed by the versioning information in the advisory. No additional mitigations are indicated.