Vulnerabilities

TI-2026-30845 CVE-2026-42565 · GHSA-vvvv-983w-r7pv

@workos/authkit-session: Open Redirect via state-derived redirect target

LOW 19

@workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00194 Published 2026-05-11 Fixed in 0.5.1 CWE-601

TI-2025-40100 CVE-2025-64762 · GHSA-p8pf-44ff-93gf

authkit-nextjs may let session cookies be cached in CDNs

MEDIUM 43

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js.

CVSS 4.0HIGH 8.0 Network No auth No interaction EPSS 0.00393 Published 2025-11-21 Fixed in 2.11.1 CWE-524

TI-2025-34711 CVE-2025-55008 · GHSA-vqvc-9q8x-vmq6

AuthKit React Router: Sensitive auth data rendered in HTML

LOW 31

The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00411 Published 2025-08-09 Fixed in 0.7.0 CWE-200

TI-2025-34712 CVE-2025-55009 · GHSA-v3gr-w9gf-23cx

AuthKit: Sensitive auth data rendered in HTML

LOW 31

The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00411 Published 2025-08-09 Fixed in 0.15.0 CWE-200

TI-2025-16829 CVE-2025-23017 · GHSA-3x3j-pmx9-j3r7

Authentication bypass in workos Hosted AuthKit

LOW 27

WorkOS Hosted AuthKit before 2025-01-07 allows a password authentication MFA bypass (by enrolling a new authentication factor) when the attacker knows the user's password.

CVSS 3.1MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00337 Published 2025-02-24 Fixed in 2025-01-07 CWE-305

TI-2024-34657 CVE-2024-51752 · GHSA-5wmg-9cvh-qw25

Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-nextjs

LOW 11

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js.

CVSS 4.0LOW 2.1 Local No auth No interaction EPSS 0.00246 Published 2024-11-05 Fixed in 0.13.2 CWE-532

TI-2024-34658 CVE-2024-51753 · GHSA-v2qh-f584-6hj8

Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-remix

LOW 11

The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix.

CVSS 4.0LOW 2.1 Local No auth No interaction EPSS 0.00217 Published 2024-11-05 Fixed in 0.4.1 CWE-532

TI-2024-19668 CVE-2024-29901 · GHSA-35w3-6qhc-474v

@workos-inc/authkit-nextjs session replay vulnerability

LOW 36

The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00659 Published 2024-03-29 Fixed in 0.4.2 CWE-294

Vulnerabilities

Filters