{"id":11947314,"name":"@workos/authkit-session","ecosystem":"npm","description":"Framework-agnostic authentication library for WorkOS with pluggable storage adapters","homepage":"https://github.com/workos/authkit-session#readme","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/workos/authkit-session","keywords_array":[],"namespace":"workos","versions_count":21,"first_release_published_at":"2025-07-25T16:36:45.998Z","latest_release_published_at":"2026-06-30T14:54:07.321Z","latest_release_number":"0.7.1","last_synced_at":"2026-10-06T11:40:13.006Z","created_at":"2025-07-25T16:36:54.290Z","updated_at":"2026-10-07T04:19:34.476Z","registry_url":"https://www.npmjs.com/package/@workos/authkit-session","install_command":"npm install @workos/authkit-session","documentation_url":null,"metadata":{"funding":null,"dist-tags":{"alpha":"0.0.1-alpha.3","beta":"0.2.0-beta.0","latest":"0.7.1"},"contentPolicy":null},"repo_metadata":{"id":307829200,"uuid":"972408074","full_name":"workos/authkit-session","owner":"workos","description":null,"archived":false,"fork":false,"pushed_at":"2026-09-23T16:16:30.000Z","size":606,"stargazers_count":12,"open_issues_count":8,"forks_count":2,"subscribers_count":3,"default_branch":"main","last_synced_at":"2026-10-01T10:30:04.852Z","etag":null,"topics":["authkit","dax","frontend"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/workos.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null}},"created_at":"2025-04-25T03:11:46.000Z","updated_at":"2026-09-23T16:17:17.000Z","dependencies_parsed_at":"2026-09-23T18:30:06.644Z","dependency_job_id":null,"html_url":"https://github.com/workos/authkit-session","commit_stats":null,"previous_names":["workos/authkit-session"],"tags_count":23,"template":false,"template_full_name":null,"purl":"pkg:github/workos/authkit-session","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/workos","download_url":"https://codeload.github.com/workos/authkit-session/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":342542704,"owners_count":37928181,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-10-02T02:00:07.254Z","response_time":104,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"workos","name":"WorkOS","uuid":"47638084","kind":"organization","description":"Your app, Enterprise Ready.","email":"support@workos.com","website":"https://workos.com","location":"United States of America","twitter":"workos","company":null,"icon_url":"https://avatars.githubusercontent.com/u/47638084?v=4","repositories_count":123,"last_synced_at":"2026-09-27T01:54:26.347Z","metadata":{"has_sponsors_listing":false,"funding":null},"html_url":"https://github.com/workos","funding_links":[],"total_stars":8574,"followers":1020,"following":0,"created_at":"2022-11-14T08:31:23.556Z","updated_at":"2026-09-27T01:54:26.357Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/workos","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/workos/repositories"},"tags":[{"name":"v0.7.1","sha":"55cbbca7ff37167a3d737f8d2eeb0b2068a92760","kind":"commit","published_at":"2026-06-30T14:53:31.000Z","download_url":"https://codeload.github.com/workos/authkit-session/tar.gz/v0.7.1","html_url":"https://github.com/workos/authkit-session/releases/tag/v0.7.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/workos/authkit-session@v0.7.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.7.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.7.1/manifests"},{"name":"v0.7.0","sha":"c1ef6aa7f26767099e64dc1e709750bbaf33c9f4","kind":"commit","published_at":"2026-06-25T22:00:30.000Z","download_url":"https://codeload.github.com/workos/authkit-session/tar.gz/v0.7.0","html_url":"https://github.com/workos/authkit-session/releases/tag/v0.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/workos/authkit-session@v0.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.7.0/manifests"},{"name":"v0.6.0","sha":"02bdbc92f998b51179930060ac21cf7e84d4e554","kind":"commit","published_at":"2026-06-15T23:00:15.000Z","download_url":"https://codeload.github.com/workos/authkit-session/tar.gz/v0.6.0","html_url":"https://github.com/workos/authkit-session/releases/tag/v0.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/workos/authkit-session@v0.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.6.0/manifests"},{"name":"v0.5.4","sha":"5b2947f4e1db47bfacae754d4ee395258e3e0a8a","kind":"commit","published_at":"2026-06-11T15:00:07.000Z","download_url":"https://codeload.github.com/workos/authkit-session/tar.gz/v0.5.4","html_url":"https://github.com/workos/authkit-session/releases/tag/v0.5.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/workos/authkit-session@v0.5.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.5.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.5.4/manifests"},{"name":"v0.5.3","sha":"9b09b78cc6f2abf70bd3431a529df5c8744eedb3","kind":"commit","published_at":"2026-06-04T21:46:01.000Z","download_url":"https://codeload.github.com/workos/authkit-session/tar.gz/v0.5.3","html_url":"https://github.com/workos/authkit-session/releases/tag/v0.5.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/workos/authkit-session@v0.5.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.5.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.5.3/manifests"},{"name":"v0.5.2","sha":"9f44a3d50f1f6a021c272aaf024139c612e1a728","kind":"commit","published_at":"2026-05-18T15:03:01.000Z","download_url":"https://codeload.github.com/workos/authkit-session/tar.gz/v0.5.2","html_url":"https://github.com/workos/authkit-session/releases/tag/v0.5.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/workos/authkit-session@v0.5.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.5.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.5.2/manifests"},{"name":"v0.5.1","sha":"d5305316beb3a7b745cb84254dd698702607fbe3","kind":"commit","published_at":"2026-04-24T19:35:27.000Z","download_url":"https://codeload.github.com/workos/authkit-session/tar.gz/v0.5.1","html_url":"https://github.com/workos/authkit-session/releases/tag/v0.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/workos/authkit-session@v0.5.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.5.1/manifests"},{"name":"v0.5.0","sha":"64e82e3bb217e24d8b5a5a7f8e9606bda91b1c78","kind":"commit","published_at":"2026-04-23T16:13:51.000Z","download_url":"https://codeload.github.com/workos/authkit-session/tar.gz/v0.5.0","html_url":"https://github.com/workos/authkit-session/releases/tag/v0.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/workos/authkit-session@v0.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.5.0/manifests"},{"name":"v0.4.0","sha":"5cb867f0bf0c301104611150a0ffbc5fafd66e19","kind":"commit","published_at":"2026-04-20T22:02:50.000Z","download_url":"https://codeload.github.com/workos/authkit-session/tar.gz/v0.4.0","html_url":"https://github.com/workos/authkit-session/releases/tag/v0.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/workos/authkit-session@v0.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.4.0/manifests"},{"name":"v0.3.4","sha":"a71aa056e9a914a17f7a31f39b2ce743a189b7d6","kind":"commit","published_at":"2026-01-12T19:25:02.000Z","download_url":"https://codeload.github.com/workos/authkit-session/tar.gz/v0.3.4","html_url":"https://github.com/workos/authkit-session/releases/tag/v0.3.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/workos/authkit-session@v0.3.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.3.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.3.4/manifests"},{"name":"v0.3.3","sha":"2302d2c6312e6cea0ee1981406a60a975c575a61","kind":"commit","published_at":"2026-01-12T19:19:33.000Z","download_url":"https://codeload.github.com/workos/authkit-session/tar.gz/v0.3.3","html_url":"https://github.com/workos/authkit-session/releases/tag/v0.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/workos/authkit-session@v0.3.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.3.3/manifests"},{"name":"v0.3.2","sha":"9f5b156486c6c7af7dde7e28b8cf165c2eac6c9e","kind":"commit","published_at":"2025-12-15T18:46:18.000Z","download_url":"https://codeload.github.com/workos/authkit-session/tar.gz/v0.3.2","html_url":"https://github.com/workos/authkit-session/releases/tag/v0.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/workos/authkit-session@v0.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.3.2/manifests"},{"name":"v0.3.1","sha":"d6dd4bbe862cc0b7f2801f9ba8f4d9b4e31ed322","kind":"commit","published_at":"2025-12-12T20:05:19.000Z","download_url":"https://codeload.github.com/workos/authkit-session/tar.gz/v0.3.1","html_url":"https://github.com/workos/authkit-session/releases/tag/v0.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/workos/authkit-session@v0.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.3.1/manifests"},{"name":"v0.3.0","sha":"24b4d95a9d97d1174a7a07435be90e65cae9ee76","kind":"commit","published_at":"2025-12-08T21:16:29.000Z","download_url":"https://codeload.github.com/workos/authkit-session/tar.gz/v0.3.0","html_url":"https://github.com/workos/authkit-session/releases/tag/v0.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/workos/authkit-session@v0.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.3.0/manifests"},{"name":"v0.2.0","sha":"a6ef2e055c1829cb6c13a55091abdbafd9897d43","kind":"commit","published_at":"2025-12-03T00:09:45.000Z","download_url":"https://codeload.github.com/workos/authkit-session/tar.gz/v0.2.0","html_url":"https://github.com/workos/authkit-session/releases/tag/v0.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/workos/authkit-session@v0.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.2.0/manifests"},{"name":"v0.2.0-beta.0","sha":"2beddec409126f2f4c7e09cc0eb0b869987e17c3","kind":"tag","published_at":"2025-11-18T19:42:25.000Z","download_url":"https://codeload.github.com/workos/authkit-session/tar.gz/v0.2.0-beta.0","html_url":"https://github.com/workos/authkit-session/releases/tag/v0.2.0-beta.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/workos/authkit-session@v0.2.0-beta.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.2.0-beta.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.2.0-beta.0/manifests"},{"name":"v0.1.3","sha":"a983b4bf60c459ec1bc18ea8ec4b43d57527c964","kind":"commit","published_at":"2025-11-06T21:06:31.000Z","download_url":"https://codeload.github.com/workos/authkit-session/tar.gz/v0.1.3","html_url":"https://github.com/workos/authkit-session/releases/tag/v0.1.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/workos/authkit-session@v0.1.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.1.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.1.3/manifests"},{"name":"v0.1.2","sha":"b353a45798142f627014f69da1c3e65450037abc","kind":"commit","published_at":"2025-10-06T14:16:04.000Z","download_url":"https://codeload.github.com/workos/authkit-session/tar.gz/v0.1.2","html_url":"https://github.com/workos/authkit-session/releases/tag/v0.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/workos/authkit-session@v0.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.1.2/manifests"},{"name":"v0.1.1","sha":"3b2c3641f3f9b3779dafd5c4f3076bf5976c5e67","kind":"commit","published_at":"2025-10-06T13:48:37.000Z","download_url":"https://codeload.github.com/workos/authkit-session/tar.gz/v0.1.1","html_url":"https://github.com/workos/authkit-session/releases/tag/v0.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/workos/authkit-session@v0.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.1.1/manifests"},{"name":"v0.1.0","sha":"5a0264c447dc243161573f7e2815a39463c4a8a2","kind":"commit","published_at":"2025-10-04T15:57:18.000Z","download_url":"https://codeload.github.com/workos/authkit-session/tar.gz/v0.1.0","html_url":"https://github.com/workos/authkit-session/releases/tag/v0.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/workos/authkit-session@v0.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.1.0/manifests"},{"name":"v0.0.1-alpha.3","sha":"afb89cb38ecf3eda1f34e9a7b760f1a6e031447c","kind":"tag","published_at":"2025-07-29T17:29:08.000Z","download_url":"https://codeload.github.com/workos/authkit-session/tar.gz/v0.0.1-alpha.3","html_url":"https://github.com/workos/authkit-session/releases/tag/v0.0.1-alpha.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/workos/authkit-session@v0.0.1-alpha.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.0.1-alpha.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.0.1-alpha.3/manifests"},{"name":"v0.0.1-alpha.2","sha":"9668cd2ec1f46c1993c3def380d1c043baec1238","kind":"tag","published_at":"2025-07-27T04:35:29.000Z","download_url":"https://codeload.github.com/workos/authkit-session/tar.gz/v0.0.1-alpha.2","html_url":"https://github.com/workos/authkit-session/releases/tag/v0.0.1-alpha.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/workos/authkit-session@v0.0.1-alpha.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.0.1-alpha.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.0.1-alpha.2/manifests"},{"name":"v0.0.1-alpha.0","sha":"76214d52f00c46c3d7b956f4d0ab1b674d8143fe","kind":"tag","published_at":"2025-04-25T03:32:00.000Z","download_url":"https://codeload.github.com/workos/authkit-session/tar.gz/v0.0.1-alpha.0","html_url":"https://github.com/workos/authkit-session/releases/tag/v0.0.1-alpha.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/workos/authkit-session@v0.0.1-alpha.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.0.1-alpha.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/tags/v0.0.1-alpha.0/manifests"}]},"repo_metadata_updated_at":"2026-10-02T09:12:24.135Z","dependent_packages_count":0,"downloads":971974,"downloads_period":"last-month","dependent_repos_count":0,"rankings":{"downloads":null,"dependent_repos_count":24.13070211695395,"dependent_packages_count":34.818311236006856,"stargazers_count":null,"forks_count":null,"docker_downloads_count":null,"average":29.474506676480402},"purl":"pkg:npm/%40workos/authkit-session","advisories":[{"uuid":"GSA_kwCzR0hTQS12dnZ2LTk4M3ctcjdwds4ABWMT","url":"https://github.com/advisories/GHSA-vvvv-983w-r7pv","title":"@workos/authkit-session has an Open Redirect via state-derived redirect target","description":"An open redirect vulnerability exists in `AuthService.handleCallback` due to insufficient validation of the `returnPathname` value derived from the OAuth `state` parameter.\n\nThe `state` parameter is round-tripped through the identity provider (IdP) and can be influenced by an attacker. The handleCallback function decodes and returns returnPathname without enforcing restrictions on origin or scheme. As a result, attacker-controlled values (e.g., `https://evil.com/`, `//evil.com`, or similar variants) may be returned to the application.\n\nIf this value is used directly in a redirect (e.g., via an HTTP `Location` header, framework redirect helpers, or client-side navigation), it may cause the user to be redirected to an external, attacker-controlled site.\n\n**Security Impact**\nThis issue may be used to facilitate phishing or user redirection attacks by leveraging the trust of the originating domain. For example, an attacker could craft a link that directs a user through a legitimate authentication flow and then redirects them to an external site.\n\nThe severity depends on how `returnPathname` is used by the application. Exploitation requires:\n\n* The application to use `returnPathname` as a redirect target, and\n* The absence of downstream validation or allowlisting\n\nThis vulnerability does not enable authentication bypass, token disclosure, or direct account compromise on its own, but may increase the effectiveness of social engineering attacks when combined with user interaction.\n\n**Vulnerability Type**\nCWE-601: URL Redirection to Untrusted Site (Open Redirect)\n\n**Patches**\nPatched in https://github.com/workos/authkit-session/releases/tag/v0.5.1","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-05-05T18:42:26.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","references":["https://github.com/workos/authkit-session/security/advisories/GHSA-vvvv-983w-r7pv","https://github.com/workos/authkit-session/commit/f56e1d6214a93160759e5677b7a3d772b244db39","https://github.com/workos/authkit-session/releases/tag/v0.5.1","https://nvd.nist.gov/vuln/detail/CVE-2026-42565","https://github.com/advisories/GHSA-vvvv-983w-r7pv"],"source_kind":"github","identifiers":["GHSA-vvvv-983w-r7pv","CVE-2026-42565"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-05-05T19:00:08.699Z","updated_at":"2026-10-07T04:04:27.956Z","epss_percentage":0.00342,"epss_percentile":0.2558,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12dnZ2LTk4M3ctcjdwds4ABWMT","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12dnZ2LTk4M3ctcjdwds4ABWMT","packages":[{"ecosystem":"npm","package_name":"@workos/authkit-session","versions":[{"first_patched_version":"0.5.1","vulnerable_version_range":"\u003c 0.5.1"}],"purl":"pkg:npm/%40workos%2Fauthkit-session"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12dnZ2LTk4M3ctcjdwds4ABWMT/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/npm/@workos/authkit-session","docker_dependents_count":null,"docker_downloads_count":null,"usage_url":"https://repos.ecosyste.ms/usage/npm/@workos/authkit-session","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/npm/@workos/authkit-session/dependencies","status":null,"funding_links":[],"critical":null,"issue_metadata":{"last_synced_at":"2026-09-25T09:09:23.763Z","issues_count":1,"pull_requests_count":29,"avg_time_to_close_issue":845592.0,"avg_time_to_close_pull_request":255273.7142857143,"issues_closed_count":1,"pull_requests_closed_count":21,"pull_request_authors_count":9,"issue_authors_count":1,"avg_comments_per_issue":0.0,"avg_comments_per_pull_request":1.5517241379310345,"merged_pull_requests_count":21,"bot_issues_count":0,"bot_pull_requests_count":10,"past_year_issues_count":1,"past_year_pull_requests_count":27,"past_year_avg_time_to_close_issue":845592.0,"past_year_avg_time_to_close_pull_request":265182.6,"past_year_issues_closed_count":1,"past_year_pull_requests_closed_count":20,"past_year_pull_request_authors_count":8,"past_year_issue_authors_count":1,"past_year_avg_comments_per_issue":0.0,"past_year_avg_comments_per_pull_request":1.6666666666666667,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":10,"past_year_merged_pull_requests_count":20,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/workos%2Fauthkit-session/issues","maintainers":[{"login":"nicknisi","count":14,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/nicknisi"}],"active_maintainers":[{"login":"nicknisi","count":13,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/nicknisi"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/@workos%2Fauthkit-session/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/@workos%2Fauthkit-session/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/@workos%2Fauthkit-session/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/@workos%2Fauthkit-session/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/@workos%2Fauthkit-session/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/@workos%2Fauthkit-session/codemeta","maintainers":[{"uuid":"gjtorikian","login":"gjtorikian","name":null,"email":"gjtorikian@gmail.com","url":null,"packages_count":66,"html_url":"https://www.npmjs.com/~gjtorikian","role":null,"created_at":"2026-03-23T10:24:17.114Z","updated_at":"2026-03-23T10:24:17.114Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/gjtorikian/packages"},{"uuid":"mark-workos","login":"mark-workos","name":null,"email":"mark@workos.com","url":null,"packages_count":108,"html_url":"https://www.npmjs.com/~mark-workos","role":null,"created_at":"2025-07-25T16:45:20.379Z","updated_at":"2025-07-25T16:45:20.379Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/mark-workos/packages"},{"uuid":"grinich","login":"grinich","name":null,"email":"mgrinich@gmail.com","url":null,"packages_count":37,"html_url":"https://www.npmjs.com/~grinich","role":null,"created_at":"2025-07-25T16:45:20.628Z","updated_at":"2025-07-25T16:45:20.628Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/grinich/packages"},{"uuid":"npm-workos","login":"npm-workos","name":null,"email":"service+npm@workos.com","url":null,"packages_count":105,"html_url":"https://www.npmjs.com/~npm-workos","role":null,"created_at":"2026-02-22T23:35:27.182Z","updated_at":"2026-02-22T23:35:27.182Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/npm-workos/packages"},{"uuid":"nicknisi","login":"nicknisi","name":null,"email":"nick@nisi.org","url":null,"packages_count":71,"html_url":"https://www.npmjs.com/~nicknisi","role":null,"created_at":"2025-07-25T16:45:20.665Z","updated_at":"2025-07-25T16:45:20.665Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/nicknisi/packages"},{"uuid":"peakematt-workos","login":"peakematt-workos","name":null,"email":"matt.peake@workos.com","url":null,"packages_count":32,"html_url":"https://www.npmjs.com/~peakematt-workos","role":null,"created_at":"2026-02-22T23:35:27.327Z","updated_at":"2026-02-22T23:35:27.327Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/peakematt-workos/packages"},{"uuid":"jacobia","login":"jacobia","name":null,"email":"jacobia@workos.com","url":null,"packages_count":23,"html_url":"https://www.npmjs.com/~jacobia","role":null,"created_at":"2026-08-18T14:42:33.879Z","updated_at":"2026-08-18T14:42:33.879Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/jacobia/packages"},{"uuid":"jch-workos","login":"jch-workos","name":null,"email":"jacob.card-howe@workos.com","url":null,"packages_count":32,"html_url":"https://www.npmjs.com/~jch-workos","role":null,"created_at":"2026-08-19T19:54:48.626Z","updated_at":"2026-08-19T19:54:48.626Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/jch-workos/packages"},{"uuid":"mjdavidson","login":"mjdavidson","name":null,"email":"matt@mattdavidson.kiwi","url":null,"packages_count":32,"html_url":"https://www.npmjs.com/~mjdavidson","role":null,"created_at":"2026-08-19T19:54:48.628Z","updated_at":"2026-08-19T19:54:48.628Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/mjdavidson/packages"}]}