Open Redirect Vulnerability in AuthKit Integration Toolkit by WorkOS

CVE-2026-42565

What is CVE-2026-42565?

The AuthKit Integration Toolkit by WorkOS has an open redirect vulnerability due to inadequate validation of the returnPathname value from the OAuth state parameter prior to version 0.5.1. An attacker could influence this state parameter while being round-tripped through the identity provider (IdP). The vulnerable handleCallback function fails to impose restrictions on the origin or scheme when decoding the returnPathname, allowing potentially malicious values to be returned to the application. If these tampered values are directly utilized in redirects, users may unknowingly be led to external, controlled sites, posing significant security risks.

References