Description

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstable_redirect() helper exported from waku/router/server (packages/waku/src/router/define-router.tsx:156–161) accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation, scheme restriction, or path-only enforcement. Any application that passes user-controlled input to this helper — the natural pattern documented in the JSDoc and official fixtures — is vulnerable to open redirect attacks. An attacker who convinces a victim to click a crafted link can silently redirect the browser to an arbitrary external domain, enabling phishing, credential harvesting, and OAuth token theft. Additionally, scheme-relative URLs (//evil.example/) bypass naive https?://-only allow-list filters that developers might add as ad-hoc mitigations. This issue has been patched in version 1.0.0-beta.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-09-03T19:17:28.250Z",
  "pubdate": "2026-09-03T19:17:28.250Z",
  "executiveSummary": "The Waku framework is susceptible to an open redirect vulnerability originating from the unstable_redirect() helper function located within waku/router/server.\nThis vulnerability exists because the function fails to perform necessary validation or sanitization on input parameters before reflecting them into the HTTP Location response header.\nAn attacker can exploit this by crafting malicious links that redirect users to arbitrary external domains, potentially leading to phishing, credential harvesting, and the theft of sensitive OAuth tokens.\nThe flaw affects Waku versions prior to 1.0.0-beta.1.\nThe risk is exacerbated by the lack of scheme restriction, which allows attackers to utilize protocol-relative URLs (e.g., //evil.example/) to bypass simplistic filter implementations that only check for specific schemes like http or https.\nExploitation requires no authentication or special privileges; it is entirely client-side, requiring only that the victim clicks a malicious link crafted to exploit a vulnerable application that consumes user-controlled input within the unstable_redirect() helper.",
  "technicalDetails": "The root cause of this vulnerability is the improper handling of user-supplied input within the unstable_redirect() function, defined in packages/waku/src/router/define-router.tsx (lines 156–161). The function is designed to facilitate server-side redirects in the Waku framework, but it inadvertently serves as an open redirect vector because it reflects input strings directly into the Location header of an HTTP response without validating the destination's structure, scheme, or domain.\nThe exploitation flow begins when an attacker identifies an application built on Waku that utilizes the unstable_redirect() helper to handle dynamic redirect destinations derived from query parameters or other user-influenced sources. The attacker crafts a URL containing a malicious redirect target. Because the framework performs no URL validation, the attacker can provide an arbitrary external domain, a path-traversal string, or a scheme-relative URL (e.g., //malicious-site.com).\nWhen a victim interacts with this crafted URL, the Waku application processes the input and generates an HTTP response with a Location header pointing to the attacker-controlled destination. The web browser, adhering to the HTTP specification, interprets this header as a directive to navigate to the provided address. Because the browser treats the redirect as originating from a trusted, legitimate source, the attacker can bypass Same-Origin Policy (SOP) constraints in various contexts, such as redirecting users to a look-alike phishing page that harvests credentials or intercepts OAuth authorization codes.\nThe vulnerability is particularly potent due to its ability to circumvent naive security measures. Developers attempting to mitigate redirect vulnerabilities often implement ad-hoc allow-lists that search for substrings like 'http://' or 'https://'. However, because the unstable_redirect() helper does not enforce host-only or path-only constraints, an attacker can supply scheme-relative payloads like '//evil.example/', which the browser interprets as a directive to remain on the same protocol while navigating to the attacker's server. This effectively neutralizes simple regex-based filters that do not account for protocol-relative bypasses.\nThe vulnerability persists in all Waku versions prior to 1.0.0-beta.1. There is no requirement for authentication, as the redirection occurs before any session-specific logic is enforced. The attack vector is strictly over the network, and the impact is limited to the end-user's interaction with the browser, resulting in a high risk for social engineering and man-in-the-middle-style credential theft."
}