CVE-2026-49456

LowCVSS 3.1

Published: 03/09/2026(UTC)Updated: 09/09/2026(UTC)Translated: 04/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

In the Waku framework (minimal React framework) prior to version 1.0.0-beta.1, the unstable_redirect() helper from waku/router/server accepts an arbitrary string and reflects it unchanged into the HTTP Location header with no URL validation, scheme restriction, or path-only enforcement. Applications passing user-controlled input to this helper are vulnerable to open redirect attacks.

Risk Assessment

An attacker can redirect victims to arbitrary external domains, enabling phishing, credential harvesting, and OAuth token theft. Scheme-relative URLs (//evil.example/) bypass naive https?:// allow-list filters.

Recommendation

Update Waku to version 1.0.0-beta.1 or later, which includes the fix. Additionally, avoid passing user input to unstable_redirect() without validation.

Other vulnerabilities in Waku

CVE-2026-49455Medium
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registered server action endpoint using a CORS-safelisted content type (text/plain), which does not trigger a preflight. Any state-mutating server action that the application exposes via 'use server' can be invoked with the victim's cookies attached. This issue has been patched in version 1.0.0-beta.1.

Original NVD description (English source)

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstable_redirect() helper exported from waku/router/server (packages/waku/src/router/define-router.tsx:156–161) accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation, scheme restriction, or path-only enforcement. Any application that passes user-controlled input to this helper — the natural pattern documented in the JSDoc and official fixtures — is vulnerable to open redirect attacks. An attacker who convinces a victim to click a crafted link can silently redirect the browser to an arbitrary external domain, enabling phishing, credential harvesting, and OAuth token theft. Additionally, scheme-relative URLs (//evil.example/) bypass naive https?://-only allow-list filters that developers might add as ad-hoc mitigations. This issue has been patched in version 1.0.0-beta.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS