WWorkOS

Products

Exploited and recent CVEs

• CVE-2026-42565 Medium 4.3 @workos/authkit-session: Open Redirect via state-derived redirect target 0.2%
• CVE-2025-64762 High 8.0 authkit-nextjs may let session cookies be cached in CDNs 0.4%
• CVE-2025-55008 High 7.1 AuthKit React Router: Sensitive auth data rendered in HTML 0.4%
• CVE-2025-55009 High 7.1 AuthKit: Sensitive auth data rendered in HTML 0.4%
• CVE-2025-23017 Medium 6.0 WorkOS Hosted AuthKit before 2025-01-07 allows a password authentication MFA bypass (by enrolling a new authentication factor) when the attacker knows the user's password. No exploitation occurred. 0.3%
• CVE-2024-51752 Low 2.1 Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-nextjs 0.2%
• CVE-2024-51753 Low 2.1 Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-remix 0.2%
• CVE-2024-29901 Medium 4.8 @workos-inc/authkit-nextjs session replay vulnerability 0.7%