CVE-2026-49456: CWE-601: URL Redirection to Untrusted Site ('Open Redirect') in wakujs waku

The wakujs waku framework's unstable_redirect() helper (in waku/router/server) prior to version 1.0.0-beta.1 accepts arbitrary strings and reflects them unchanged into the HTTP Location response header without URL validation, scheme restriction, or path-only enforcement. Applications passing user input to this helper are vulnerable to open redirect attacks. Attackers can craft URLs that redirect victims to malicious external domains, enabling phishing and token theft. Scheme-relative URLs (e.g., //evil.example/) bypass simple https?:// allow-lists. The vulnerability is fixed in version 1.0.0-beta.1.

An attacker can exploit this vulnerability to redirect users to malicious external websites, potentially leading to phishing attacks, credential harvesting, and OAuth token theft. The vulnerability does not impact confidentiality or availability directly but poses an integrity risk through user redirection. The CVSS score is 3.1 (low severity) reflecting the requirement for user interaction and high attack complexity.

This vulnerability is patched in waku version 1.0.0-beta.1. Users and developers should upgrade to this version or later to remediate the issue. Until upgrading, avoid passing untrusted user input to the unstable_redirect() helper or implement strict URL validation and scheme restrictions. No official vendor advisory was provided, so check the wakujs project repository for the patch and further guidance.