CVE-2026-49456

Name of the Vulnerable Software and Affected Versions Waku versions prior to 1.0.0-beta.1

Description The unstable redirect() function exported from waku/router/server accepts an arbitrary string and reflects it unchanged into the HTTP Location response header without URL validation, scheme restriction, or path-only enforcement. When applications pass user-controlled input to this function, it enables open redirect attacks. An attacker can use a crafted link to redirect users to an external domain for phishing, credential harvesting, or OAuth token theft. Additionally, scheme-relative URLs (starting with //) can bypass simple filters that only check for http:// or https://. The issue occurs because the location variable is passed through createCustomError() and getErrorInfo() and is eventually reflected into the headers.location of the outgoing response without sanitization.

Recommendations Update to version 1.0.0-beta.1. As a temporary workaround, avoid passing user-controlled input to the unstable redirect() function.