CVE-2025-23017

Vulnerability summary (CVE-2025-23017) : WorkOS Hosted AuthKit before 2025-01-07 is affected. An attacker who knows a user’s password can bypass MFA by enrolling a new authentication factor. The description notes that no exploitation occurred. The practical impact is a password-authentication MFA...

Information Exposure

@workos-inc/authkit-remix is vulnerable to Information Exposure. The vulnerability is due to the debug flag being enabled, which allows an attacker to view refresh tokens logged to the console...

CVE-2024-51752

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In affected versions refresh tokens are logged to the console when the disabled by default debug flag, is enabled. This issue has been patched in version 0.13...

CVE-2024-51752

The CVE-2024-51752 entry concerns the AuthKit Next.js library for WorkOS/AuthKit integration. Affected versions log refresh tokens to the console when the debug flag is enabled, enabling potential token exposure through logs. The issue has a patched fix in version 0.13.2; upgrading to that versio...

CVE-2024-51753 Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-remix

The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In affected versions refresh tokens are logged to the console when the disabled by default debug flag, is enabled. This issue has been patched in version 0.4.1. A...

@workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled

Impact Refresh tokens are logged to the console when the disabled by default debug flag, is enabled. Patches Patched in https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2...

AuthKit Remix Library 日志信息泄露漏洞

AuthKit Remix Library is a WorkOS open source library for authentication and session management. A logging information disclosure vulnerability exists in the AuthKit Remix Library, where a refresh token is logged to the console when the "debug" flag is enabled, which is disabled by default...

AuthKit Next.js Library 日志信息泄露漏洞

AuthKit Next.js Library is an open source Next.js AuthKit library for WorkOS. A logging information disclosure vulnerability exists in the AuthKit Next.js Library, where a refresh token is logged to the console when the "debug" flag is enabled, which is disabled by default...

CVE-2024-29901

The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js. A user can reuse an expired session by controlling the x-workos-session header. The vulnerability is patched in v0.4.2...

CVE-2024-29901 @workos-inc/authkit-nextjs session replay vulnerability

The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js. A user can reuse an expired session by controlling the x-workos-session header. The vulnerability is patched in v0.4.2...

CVE-2024-29901 @workos-inc/authkit-nextjs session replay vulnerability

The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js. A user can reuse an expired session by controlling the x-workos-session header. The vulnerability is patched in v0.4.2...

CVE-2024-29901

CVE-2024-29901 concerns the AuthKit Next.js library. The issue arises from improper handling of expired sessions, allowing an attacker to reuse an expired session by controlling the x-workos-session header. Affected component: workOS/AuthKit Next.js integration (authkit-nextjs). Impact is describ...

AuthKit Next.js Library 安全漏洞

AuthKit Next.js Library is an open source AuthKit library for Next.js for WorkOS. A security vulnerability exists in AuthKit Next.js Library that originated from allowing an attacker to reuse expired sessions by controlling the x-workos-session header...

PT-2024-23122

Name of the Vulnerable Software and Affected Versions AuthKit library for Next.js versions prior to 0.4.2 Description The issue allows a user to reuse an expired session by controlling the x-workos-session header. This can be exploited to bypass session expiration. Recommendations For versions...