CVE-2026-42565

Summary of CVE-2026-42565 : In @workos/authkit-session, prior to version 0.5.1, AuthService.handleCallback decodes and returns the returnPathname derived from the OAuth state parameter without validating origin or scheme. Attackers who influence the state can cause an attacker-controlled URL to b...

GHSA-VVVV-983W-R7PV @workos/authkit-session has an Open Redirect via state-derived redirect target

An open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth state parameter. The state parameter is round-tripped through the identity provider IdP and can be influenced by an attacker. The handleCallback...

@studiocms/migrator (>=0.1.0-beta.1, <=0.2.1), @withstudiocms/auth-kit (>=0.1.0-beta.1, <=0.1.3) +2 more potentially affected by CVE-2026-32638 via @withstudiocms/effect (>=0.1.0, <=0.3.0)

@withstudiocms/effect NPM version =0.1.0, =0.1.0-beta.1, =0.1.0-beta.1, =0.1.0-beta.1, =0.1.0-beta.25, =0.3.0 Source cves: CVE-2026-32638 Source advisory: SNYK:JS-WITHSTUDIOCMSEFFECT-15682415...

studiocms (>=0.1.0-beta.26, <=0.1.0) potentially affected by CVE-2026-30945 via @withstudiocms/auth-kit (0.1.0-beta.6)

@withstudiocms/auth-kit NPM version 0.1.0-beta.6 is affected by a known vulnerability. The following packages have a transitive dependency on @withstudiocms/auth-kit and may be impacted: - studiocms =0.1.0-beta.26, =0.1.0 Source cves: CVE-2026-30945 Source advisory:...

studiocms (>=0.1.0-beta.26, <=0.1.0) potentially affected by CVE-2026-30944 via @withstudiocms/auth-kit (0.1.0-beta.6)

@withstudiocms/auth-kit NPM version 0.1.0-beta.6 is affected by a known vulnerability. The following packages have a transitive dependency on @withstudiocms/auth-kit and may be impacted: - studiocms =0.1.0-beta.26, =0.1.0 Source cves: CVE-2026-30944 Source advisory:...

Incorrect Authorization

Overview @withstudiocms/auth-kit is an Utilities for managing authentication Affected versions of this package are vulnerable to Incorrect Authorization through the api-tokens endpoint, which allows an authenticated user with editor privileges or higher to generate API tokens for any user by...