wakujs Waku up to 1.0.0-beta.0 Router define-router.tsx unstable_redirect

Summaryinfo

A vulnerability labeled as problematic has been found in wakujs Waku up to 1.0.0-beta.0. The impacted element is the function unstable_redirect of the file packages/waku/src/router/define-router.tsx of the component Router. Executing a manipulation can lead to redirect. This vulnerability appears as CVE-2026-49456. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic was found in wakujs Waku up to 1.0.0-beta.0. This vulnerability affects the function unstable_redirect of the file packages/waku/src/router/define-router.tsx of the component Router. The manipulation with an unknown input leads to a redirect vulnerability. The CWE definition for the vulnerability is CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. As an impact it is known to affect integrity. CVE summarizes:

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstable_redirect() helper exported from waku/router/server (packages/waku/src/router/define-router.tsx:156–161) accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation, scheme restriction, or path-only enforcement. Any application that passes user-controlled input to this helper — the natural pattern documented in the JSDoc and official fixtures — is vulnerable to open redirect attacks. An attacker who convinces a victim to click a crafted link can silently redirect the browser to an arbitrary external domain, enabling phishing, credential harvesting, and OAuth token theft. Additionally, scheme-relative URLs (//evil.example/) bypass naive https?://-only allow-list filters that developers might add as ad-hoc mitigations. This issue has been patched in version 1.0.0-beta.1.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-49456 since 05/30/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1204.001.

Upgrading to version 1.0.0-beta.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• wakujs

Name

• Waku

Version

• 1.0.0-beta

Website

• Product: https://github.com/wakujs/waku/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion