CVE-2026-49456
Received Received - Intake

Open Redirect in Waku React Framework

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: GitHub, Inc.

Description
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstable_redirect() helper exported from waku/router/server (packages/waku/src/router/define-router.tsx:156–161) accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation, scheme restriction, or path-only enforcement. Any application that passes user-controlled input to this helper — the natural pattern documented in the JSDoc and official fixtures — is vulnerable to open redirect attacks. An attacker who convinces a victim to click a crafted link can silently redirect the browser to an arbitrary external domain, enabling phishing, credential harvesting, and OAuth token theft. Additionally, scheme-relative URLs (//evil.example/) bypass naive https?://-only allow-list filters that developers might add as ad-hoc mitigations. This issue has been patched in version 1.0.0-beta.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-04
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-49456
EUVD
EUVD-2026-70655

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
waku waku to 1.0.0-beta.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an open redirect issue in Waku, a React framework. The unstable_redirect() helper function in waku/router/server reflects user-controlled input directly into the HTTP Location response header without validation. This allows attackers to craft links that redirect victims to malicious external domains, enabling phishing or credential theft.

Detection Guidance

To detect this vulnerability, inspect your application code for usage of the unstable_redirect() helper in waku/router/server. Search for any instances where user-controlled input is passed to this function. Check HTTP response headers for Location fields containing unvalidated user input or external domains.

Impact Analysis

If you use Waku versions before 1.0.0-beta.1 and pass user input to unstable_redirect(), attackers can trick you or your users into clicking links that silently redirect to harmful sites. This could lead to stolen credentials, phishing attacks, or theft of OAuth tokens without your knowledge.

Compliance Impact

This vulnerability enables open redirect attacks, which could allow attackers to redirect users to malicious domains. This could facilitate phishing attacks, credential harvesting, or OAuth token theft, potentially violating data protection principles under GDPR and HIPAA by exposing sensitive user data or enabling unauthorized access to protected systems.

Mitigation Strategies

Upgrade to Waku version 1.0.0-beta.1 or later. If upgrading is not immediately possible, remove or replace all uses of unstable_redirect() with a secure redirect function that validates URLs. Implement strict allow-lists for redirect targets and avoid reflecting user input in Location headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49456. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart