CVE-2026-42565

Summary of CVE-2026-42565 : In @workos/authkit-session, prior to version 0.5.1, AuthService.handleCallback decodes and returns the returnPathname derived from the OAuth state parameter without validating origin or scheme. Attackers who influence the state can cause an attacker-controlled URL to b...

GHSA-VVVV-983W-R7PV @workos/authkit-session has an Open Redirect via state-derived redirect target

An open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth state parameter. The state parameter is round-tripped through the identity provider IdP and can be influenced by an attacker. The handleCallback...

@studiocms/migrator (>=0.1.0 <=0.2.1), @withstudiocms/auth-kit (>=0.1.0 <=0.1.3) +2 more potentially affected by CVE-2026-32638 via @withstudiocms/effect (>=0.1.0-beta.1 <=0.3.0)

@withstudiocms/effect NPM version =0.1.0-beta.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0 Source cves: CVE-2026-32638 Source advisory: SNYK:JS-WITHSTUDIOCMSEFFECT-15682415...

studiocms (>=0.1.0 <=0.1.0-beta.31) potentially affected by CVE-2026-30945 via @withstudiocms/auth-kit (>=0.1.0-beta.1 <=0.1.0)

@withstudiocms/auth-kit NPM version =0.1.0-beta.1, =0.1.0, =0.1.0-beta.31 Source cves: CVE-2026-30945 Source advisory: SNYK:JS-WITHSTUDIOCMSAUTHKIT-15518584...

studiocms (>=0.1.0 <=0.1.0-beta.31) potentially affected by CVE-2026-30944 via @withstudiocms/auth-kit (>=0.1.0-beta.1 <=0.1.0)

@withstudiocms/auth-kit NPM version =0.1.0-beta.1, =0.1.0, =0.1.0-beta.31 Source cves: CVE-2026-30944 Source advisory: SNYK:JS-WITHSTUDIOCMSAUTHKIT-15518581...

Incorrect Authorization

Overview @withstudiocms/auth-kit is an Utilities for managing authentication Affected versions of this package are vulnerable to Incorrect Authorization through the api-tokens endpoint, which allows an authenticated user with editor privileges or higher to generate API tokens for any user by...

django-daiquiri (>=1.3.0 <=1.3.1), django-jwt-allauth (>=1.0.3 <=1.2.0) +5 more potentially affected by CVE-2025-65431 via django-allauth (>=65.0.1 <=65.12.1)

django-allauth PYPI version =65.0.1, =1.3.0, =1.0.3, =0.3.8, =4.0.0, =2.0.0, =1.1.1, =1.1.2 Source cves: CVE-2025-65431 Source advisory: SNYK:PYTHON-DJANGOALLAUTH-14425069...