Executive brief
A security vulnerability in the WorkOS AuthKit session library could allow attackers to redirect users to malicious websites. This occurs during the login process when the application fails to properly check the destination URL after authentication. An attacker could use this to trick users into visiting phishing sites that look like legitimate corporate login pages, potentially leading to credential theft or further social engineering attacks.
Technical details
An open redirect vulnerability (CWE-601) exists in `AuthService.handleCallback` within the `@workos/authkit-session` package. The root cause is the insufficient validation of the `returnPathname` value, which is derived from the OAuth `state` parameter. Because the `state` parameter is round-tripped through the Identity Provider (IdP), an attacker can manipulate it to include arbitrary URLs. The `handleCallback` function decodes this value and returns it without enforcing origin or scheme restrictions. If the application uses this returned value directly in a redirect (e.g., via HTTP Location headers or client-side navigation) without downstream validation, a user can be redirected to an attacker-controlled domain. This issue is patched in version 0.5.1.
Affected products
- WorkOS @workos/authkit-session < 0.5.1
Timeline
- 2026-04-24: disclosed: Initial report/publication by maintainer
- 2026-05-05: advisory: GitHub Advisory published
- 2026-05-11: other: NVD published date