Skip to content
OpenAdvisories

Vendor

workos

8 known vulnerabilities.

Products

authkit-nextjs 3 authkit-remix 2 Hosted AuthKit 1 authkit-session 1 authkit-react-router 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-42565

    @workos/authkit-session: Open Redirect via state-derived redirect target

    @workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations. Prior to 0.5.1, an open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth stat…

    workos authkit-session @workos/authkit-session npm
  • Medium 6.0
    CVE-2025-23017

    WorkOS Hosted AuthKit before 2025-01-07 allows a password authentication MFA bypass (by enrolling a new authentication …

    workos Hosted AuthKit
  • Medium 4.8
    CVE-2024-29901

    @workos-inc/authkit-nextjs session replay vulnerability

    The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js. A user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2.

    workos authkit-nextjs @workos-inc/authkit-nextjs npm