CVE-2026-42565 — Open Redirect

May 11, 2026 23:25 /MEDIUM /CVSS 4.3/10

Written by SCW Vulnerability Desk Vulnerability Intelligence

National Vulnerability Database vulnerabilitycvemedium-severityopen-redirectcwe-601

CVE-2026-42565 — Open Redirect

CVE-2026-42565 — @workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations. Prior to 0.5.1, an open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth state parameter. The state p

What This Means For You

If your environment is affected by CWE-601, review your exposure and prioritize patching based on your environment. Monitor vendor advisories for CVE-2026-42565 updates and patches.

Related ATT&CK Techniques

T1190 Exploit Public-Facing Application Initial Access T1566.002 Phishing: Spearphishing Link Initial Access

🛡️ Detection Rules

2 rules · 6 SIEM formats

2 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.

medium T1190 Initial Access

CVE-2026-42565 - Open Redirect in WorkOS AuthKit Session

Sigma YAML — free preview

title: CVE-2026-42565 - Open Redirect in WorkOS AuthKit Session
id: scw-2026-05-11-ai-1
status: experimental
level: medium
description: |
  Detects potential exploitation of CVE-2026-42565, an open redirect vulnerability in @workos/authkit-session. This rule looks for requests to the '/auth/callback' endpoint that contain a 'returnPathname=' parameter in the query string, which is indicative of the vulnerable function handleCallback being invoked with a potentially manipulated state parameter.
author: SCW Feed Engine (AI-generated)
date: 2026-05-11
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-42565/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      uri|contains:
          - '/auth/callback'
      cs-uri-query|contains:
          - 'returnPathname='
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse

✓ Sigma · Splunk SPL Sentinel KQL Elastic QRadar AQL Wazuh Get rules for your SIEM →

Indicators of Compromise

ID	Type	Indicator
CVE-2026-42565	vulnerability	CVE-2026-42565
CWE-601	weakness	CWE-601

Written by SCW Vulnerability Desk

Source & Attribution

Source Platform	NVD
Channel	National Vulnerability Database
Published	May 11, 2026 at 23:25 UTC

This content was curated and summarized by Shimi's Cyber World for informational purposes. It is not copied or republished in full. All intellectual property rights remain with the original author and source.

Believe this infringes your rights? Submit a takedown request.

Follow

Share