Search
Find a vulnerability
Search criteria
16 vulnerabilities by workos
CVE-2026-42565 (GCVE-0-2026-42565)
Vulnerability from nvd – Published: 2026-05-11 19:01 – Updated: 2026-05-12 16:30
VLAI
Title
@workos/authkit-session: Open Redirect via state-derived redirect target
Summary
@workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations. Prior to 0.5.1, an open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth state parameter. The state parameter is round-tripped through the identity provider (IdP) and can be influenced by an attacker. The handleCallback function decodes and returns returnPathname without enforcing restrictions on origin or scheme. As a result, attacker-controlled values may be returned to the application. If this value is used directly in a redirect, it may cause the user to be redirected to an external, attacker-controlled site. This vulnerability is fixed in 0.5.1.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/workos/authkit-session/securit… | x_refsource_CONFIRM |
| https://github.com/workos/authkit-session/commit/… | x_refsource_MISC |
| https://github.com/workos/authkit-session/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| workos | authkit-session |
Affected:
< 0.5.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42565",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-12T16:30:19.568319Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T16:30:33.422Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "authkit-session",
"vendor": "workos",
"versions": [
{
"status": "affected",
"version": "\u003c 0.5.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "@workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations. Prior to 0.5.1, an open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth state parameter. The state parameter is round-tripped through the identity provider (IdP) and can be influenced by an attacker. The handleCallback function decodes and returns returnPathname without enforcing restrictions on origin or scheme. As a result, attacker-controlled values may be returned to the application. If this value is used directly in a redirect, it may cause the user to be redirected to an external, attacker-controlled site. This vulnerability is fixed in 0.5.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T19:01:28.340Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/workos/authkit-session/security/advisories/GHSA-vvvv-983w-r7pv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/workos/authkit-session/security/advisories/GHSA-vvvv-983w-r7pv"
},
{
"name": "https://github.com/workos/authkit-session/commit/f56e1d6214a93160759e5677b7a3d772b244db39",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-session/commit/f56e1d6214a93160759e5677b7a3d772b244db39"
},
{
"name": "https://github.com/workos/authkit-session/releases/tag/v0.5.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-session/releases/tag/v0.5.1"
}
],
"source": {
"advisory": "GHSA-vvvv-983w-r7pv",
"discovery": "UNKNOWN"
},
"title": "@workos/authkit-session: Open Redirect via state-derived redirect target"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42565",
"datePublished": "2026-05-11T19:01:28.340Z",
"dateReserved": "2026-04-28T17:26:12.084Z",
"dateUpdated": "2026-05-12T16:30:33.422Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-64762 (GCVE-0-2025-64762)
Vulnerability from nvd – Published: 2025-11-21 01:29 – Updated: 2025-11-24 18:09
VLAI
Title
authkit-nextjs may let session cookies be cached in CDNs
Summary
The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users. Next.js applications deployed on Vercel are unaffected unless they manually enable CDN caching by setting cache headers on authenticated paths. Patched in authkit-nextjs 2.11.1, which applies anti-caching headers to all responses behind authentication.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-524 - Use of Cache Containing Sensitive Information
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/workos/authkit-nextjs/security… | x_refsource_CONFIRM |
| https://github.com/workos/authkit-nextjs/commit/9… | x_refsource_MISC |
| https://github.com/workos/authkit-nextjs/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| workos | authkit-nextjs |
Affected:
< 2.11.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-64762",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-24T17:03:08.522780Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-24T18:09:43.225Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "authkit-nextjs",
"vendor": "workos",
"versions": [
{
"status": "affected",
"version": "\u003c 2.11.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS \u0026 AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users. Next.js applications deployed on Vercel are unaffected unless they manually enable CDN caching by setting cache headers on authenticated paths. Patched in authkit-nextjs 2.11.1, which applies anti-caching headers to all responses behind authentication."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-524",
"description": "CWE-524: Use of Cache Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-21T01:29:22.606Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/workos/authkit-nextjs/security/advisories/GHSA-p8pf-44ff-93gf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/workos/authkit-nextjs/security/advisories/GHSA-p8pf-44ff-93gf"
},
{
"name": "https://github.com/workos/authkit-nextjs/commit/94cf438124993abb0e7c19dac64c3cb5724a15ea",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-nextjs/commit/94cf438124993abb0e7c19dac64c3cb5724a15ea"
},
{
"name": "https://github.com/workos/authkit-nextjs/releases/tag/v2.11.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-nextjs/releases/tag/v2.11.1"
}
],
"source": {
"advisory": "GHSA-p8pf-44ff-93gf",
"discovery": "UNKNOWN"
},
"title": "authkit-nextjs may let session cookies be cached in CDNs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-64762",
"datePublished": "2025-11-21T01:29:22.606Z",
"dateReserved": "2025-11-10T22:29:34.876Z",
"dateUpdated": "2025-11-24T18:09:43.225Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-55009 (GCVE-0-2025-55009)
Vulnerability from nvd – Published: 2025-08-09 02:02 – Updated: 2025-08-11 14:35
VLAI
Title
AuthKit: Sensitive auth data rendered in HTML
Summary
The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In versions 0.14.1 and below, @workos-inc/authkit-remix exposed sensitive authentication artifacts — specifically sealedSession and accessToken — by returning them from the authkitLoader. This caused them to be rendered into the browser HTML.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/workos/authkit-remix/security/… | x_refsource_CONFIRM |
| https://github.com/workos/authkit-remix/commit/20… | x_refsource_MISC |
| https://github.com/workos/authkit-remix/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| workos | authkit-remix |
Affected:
< 0.15.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-55009",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-11T14:35:41.842990Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-11T14:35:52.345Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "authkit-remix",
"vendor": "workos",
"versions": [
{
"status": "affected",
"version": "\u003c 0.15.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS \u0026 AuthKit with Remix. In versions 0.14.1 and below, @workos-inc/authkit-remix exposed sensitive authentication artifacts \u2014 specifically sealedSession and accessToken \u2014 by returning them from the authkitLoader. This caused them to be rendered into the browser HTML."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-09T02:02:07.611Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/workos/authkit-remix/security/advisories/GHSA-v3gr-w9gf-23cx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/workos/authkit-remix/security/advisories/GHSA-v3gr-w9gf-23cx"
},
{
"name": "https://github.com/workos/authkit-remix/commit/20102afc74bf3dd5150a975a098067fb406b90b6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-remix/commit/20102afc74bf3dd5150a975a098067fb406b90b6"
},
{
"name": "https://github.com/workos/authkit-remix/releases/tag/v0.15.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-remix/releases/tag/v0.15.0"
}
],
"source": {
"advisory": "GHSA-v3gr-w9gf-23cx",
"discovery": "UNKNOWN"
},
"title": "AuthKit: Sensitive auth data rendered in HTML"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-55009",
"datePublished": "2025-08-09T02:02:07.611Z",
"dateReserved": "2025-08-04T17:34:24.422Z",
"dateUpdated": "2025-08-11T14:35:52.345Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-55008 (GCVE-0-2025-55008)
Vulnerability from nvd – Published: 2025-08-09 02:02 – Updated: 2025-08-11 14:33
VLAI
Title
AuthKit React Router: Sensitive auth data rendered in HTML
Summary
The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router. In versions 0.6.1 and below, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically sealedSession and accessToken by returning them from the authkitLoader. This caused them to be rendered into the browser HTML. This issue is fixed in version 0.7.0.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/workos/authkit-react-router/se… | x_refsource_CONFIRM |
| https://github.com/workos/authkit-react-router/co… | x_refsource_MISC |
| https://github.com/workos/authkit-react-router/re… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| workos | authkit-react-router |
Affected:
< 0.7.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-55008",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-11T14:32:24.190307Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-11T14:33:33.678Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "authkit-react-router",
"vendor": "workos",
"versions": [
{
"status": "affected",
"version": "\u003c 0.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS \u0026 AuthKit with React Router. In versions 0.6.1 and below, @workos-inc/authkit-react-router exposed sensitive authentication artifacts \u2014 specifically sealedSession and accessToken by returning them from the authkitLoader. This caused them to be rendered into the browser HTML. This issue is fixed in version 0.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-09T02:02:14.950Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/workos/authkit-react-router/security/advisories/GHSA-vqvc-9q8x-vmq6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/workos/authkit-react-router/security/advisories/GHSA-vqvc-9q8x-vmq6"
},
{
"name": "https://github.com/workos/authkit-react-router/commit/607caac658784962bab76e227f9c5820d0b9a9e5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-react-router/commit/607caac658784962bab76e227f9c5820d0b9a9e5"
},
{
"name": "https://github.com/workos/authkit-react-router/releases/tag/v0.7.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-react-router/releases/tag/v0.7.0"
}
],
"source": {
"advisory": "GHSA-vqvc-9q8x-vmq6",
"discovery": "UNKNOWN"
},
"title": "AuthKit React Router: Sensitive auth data rendered in HTML"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-55008",
"datePublished": "2025-08-09T02:02:14.950Z",
"dateReserved": "2025-08-04T17:34:24.422Z",
"dateUpdated": "2025-08-11T14:33:33.678Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-23017 (GCVE-0-2025-23017)
Vulnerability from nvd – Published: 2025-02-24 00:00 – Updated: 2025-02-24 16:01 Exclusively Hosted Service
VLAI
Summary
WorkOS Hosted AuthKit before 2025-01-07 allows a password authentication MFA bypass (by enrolling a new authentication factor) when the attacker knows the user's password. No exploitation occurred.
Severity
6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-305 - Authentication Bypass by Primary Weakness
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WorkOS | Hosted AuthKit |
Affected:
0 , < 2025-01-07
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-23017",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-24T16:01:14.574929Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-24T16:01:35.824Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Hosted AuthKit",
"vendor": "WorkOS",
"versions": [
{
"lessThan": "2025-01-07",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "WorkOS Hosted AuthKit before 2025-01-07 allows a password authentication MFA bypass (by enrolling a new authentication factor) when the attacker knows the user\u0027s password. No exploitation occurred."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305 Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-24T15:21:20.843Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://workos.com/security/advisories"
},
{
"url": "https://www.authkit.com"
}
],
"tags": [
"exclusively-hosted-service"
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-23017",
"datePublished": "2025-02-24T00:00:00.000Z",
"dateReserved": "2025-01-10T00:00:00.000Z",
"dateUpdated": "2025-02-24T16:01:35.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-51753 (GCVE-0-2024-51753)
Vulnerability from nvd – Published: 2024-11-05 19:14 – Updated: 2024-11-05 20:16
VLAI
Title
Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-remix
Summary
The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In affected versions refresh tokens are logged to the console when the disabled by default `debug` flag, is enabled. This issue has been patched in version 0.4.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/workos/authkit-remix/security/… | x_refsource_CONFIRM |
| https://github.com/workos/authkit-remix/commit/32… | x_refsource_MISC |
| https://github.com/workos/authkit-remix/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| workos | authkit-remix |
Affected:
< 0.4.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-51753",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-05T20:15:29.247219Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T20:16:29.928Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "authkit-remix",
"vendor": "workos",
"versions": [
{
"status": "affected",
"version": "\u003c 0.4.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS \u0026 AuthKit with Remix. In affected versions refresh tokens are logged to the console when the disabled by default `debug` flag, is enabled. This issue has been patched in version 0.4.1. All users are advised to upgrade. There are no known workarounds for this vulnerability."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532: Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T19:14:47.097Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/workos/authkit-remix/security/advisories/GHSA-v2qh-f584-6hj8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/workos/authkit-remix/security/advisories/GHSA-v2qh-f584-6hj8"
},
{
"name": "https://github.com/workos/authkit-remix/commit/32d5bcd54c795c1e2a3204f8e3977ab9ad57ec06",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-remix/commit/32d5bcd54c795c1e2a3204f8e3977ab9ad57ec06"
},
{
"name": "https://github.com/workos/authkit-remix/releases/tag/v0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-remix/releases/tag/v0.4.1"
}
],
"source": {
"advisory": "GHSA-v2qh-f584-6hj8",
"discovery": "UNKNOWN"
},
"title": "Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-remix"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-51753",
"datePublished": "2024-11-05T19:14:47.097Z",
"dateReserved": "2024-10-31T14:12:45.791Z",
"dateUpdated": "2024-11-05T20:16:29.928Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-51752 (GCVE-0-2024-51752)
Vulnerability from nvd – Published: 2024-11-05 19:16 – Updated: 2024-11-05 20:15
VLAI
Title
Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-nextjs
Summary
The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In affected versions refresh tokens are logged to the console when the disabled by default `debug` flag, is enabled. This issue has been patched in version 0.13.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/workos/authkit-nextjs/security… | x_refsource_CONFIRM |
| https://github.com/workos/authkit-nextjs/commit/1… | x_refsource_MISC |
| https://github.com/workos/authkit-nextjs/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| workos | authkit-nextjs |
Affected:
< 0.13.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-51752",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-05T20:14:57.346838Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T20:15:07.923Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "authkit-nextjs",
"vendor": "workos",
"versions": [
{
"status": "affected",
"version": "\u003c 0.13.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS \u0026 AuthKit with Next.js. In affected versions refresh tokens are logged to the console when the disabled by default `debug` flag, is enabled. This issue has been patched in version 0.13.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532: Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T19:16:41.831Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/workos/authkit-nextjs/security/advisories/GHSA-5wmg-9cvh-qw25",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/workos/authkit-nextjs/security/advisories/GHSA-5wmg-9cvh-qw25"
},
{
"name": "https://github.com/workos/authkit-nextjs/commit/15a332632f7560b03cc6d8cc8da24fd2ac931da7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-nextjs/commit/15a332632f7560b03cc6d8cc8da24fd2ac931da7"
},
{
"name": "https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2"
}
],
"source": {
"advisory": "GHSA-5wmg-9cvh-qw25",
"discovery": "UNKNOWN"
},
"title": "Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-nextjs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-51752",
"datePublished": "2024-11-05T19:16:41.831Z",
"dateReserved": "2024-10-31T14:12:45.791Z",
"dateUpdated": "2024-11-05T20:15:07.923Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-29901 (GCVE-0-2024-29901)
Vulnerability from nvd – Published: 2024-03-29 15:23 – Updated: 2024-08-02 01:17
VLAI
Title
@workos-inc/authkit-nextjs session replay vulnerability
Summary
The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js.
A user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-294 - Authentication Bypass by Capture-replay
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/workos/authkit-nextjs/security… | x_refsource_CONFIRM |
| https://github.com/workos/authkit-nextjs/commit/6… | x_refsource_MISC |
| https://github.com/workos/authkit-nextjs/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| workos | authkit-nextjs |
Affected:
< 0.4.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-29901",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-08T18:05:37.365811Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-08T20:06:40.754Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:17:58.024Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/workos/authkit-nextjs/security/advisories/GHSA-35w3-6qhc-474v",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/workos/authkit-nextjs/security/advisories/GHSA-35w3-6qhc-474v"
},
{
"name": "https://github.com/workos/authkit-nextjs/commit/6c3f4f3179d66cbb15de3962792083ff3b244a01",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/workos/authkit-nextjs/commit/6c3f4f3179d66cbb15de3962792083ff3b244a01"
},
{
"name": "https://github.com/workos/authkit-nextjs/releases/tag/v0.4.2",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/workos/authkit-nextjs/releases/tag/v0.4.2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "authkit-nextjs",
"vendor": "workos",
"versions": [
{
"status": "affected",
"version": "\u003c 0.4.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS \u0026 AuthKit with Next.js.\nA user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-294",
"description": "CWE-294: Authentication Bypass by Capture-replay",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-29T15:23:02.184Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/workos/authkit-nextjs/security/advisories/GHSA-35w3-6qhc-474v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/workos/authkit-nextjs/security/advisories/GHSA-35w3-6qhc-474v"
},
{
"name": "https://github.com/workos/authkit-nextjs/commit/6c3f4f3179d66cbb15de3962792083ff3b244a01",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-nextjs/commit/6c3f4f3179d66cbb15de3962792083ff3b244a01"
},
{
"name": "https://github.com/workos/authkit-nextjs/releases/tag/v0.4.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-nextjs/releases/tag/v0.4.2"
}
],
"source": {
"advisory": "GHSA-35w3-6qhc-474v",
"discovery": "UNKNOWN"
},
"title": "@workos-inc/authkit-nextjs session replay vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-29901",
"datePublished": "2024-03-29T15:23:02.184Z",
"dateReserved": "2024-03-21T15:12:09.000Z",
"dateUpdated": "2024-08-02T01:17:58.024Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-42565 (GCVE-0-2026-42565)
Vulnerability from cvelistv5 – Published: 2026-05-11 19:01 – Updated: 2026-05-12 16:30
VLAI
Title
@workos/authkit-session: Open Redirect via state-derived redirect target
Summary
@workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations. Prior to 0.5.1, an open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth state parameter. The state parameter is round-tripped through the identity provider (IdP) and can be influenced by an attacker. The handleCallback function decodes and returns returnPathname without enforcing restrictions on origin or scheme. As a result, attacker-controlled values may be returned to the application. If this value is used directly in a redirect, it may cause the user to be redirected to an external, attacker-controlled site. This vulnerability is fixed in 0.5.1.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/workos/authkit-session/securit… | x_refsource_CONFIRM |
| https://github.com/workos/authkit-session/commit/… | x_refsource_MISC |
| https://github.com/workos/authkit-session/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| workos | authkit-session |
Affected:
< 0.5.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42565",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-12T16:30:19.568319Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T16:30:33.422Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "authkit-session",
"vendor": "workos",
"versions": [
{
"status": "affected",
"version": "\u003c 0.5.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "@workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations. Prior to 0.5.1, an open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth state parameter. The state parameter is round-tripped through the identity provider (IdP) and can be influenced by an attacker. The handleCallback function decodes and returns returnPathname without enforcing restrictions on origin or scheme. As a result, attacker-controlled values may be returned to the application. If this value is used directly in a redirect, it may cause the user to be redirected to an external, attacker-controlled site. This vulnerability is fixed in 0.5.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T19:01:28.340Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/workos/authkit-session/security/advisories/GHSA-vvvv-983w-r7pv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/workos/authkit-session/security/advisories/GHSA-vvvv-983w-r7pv"
},
{
"name": "https://github.com/workos/authkit-session/commit/f56e1d6214a93160759e5677b7a3d772b244db39",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-session/commit/f56e1d6214a93160759e5677b7a3d772b244db39"
},
{
"name": "https://github.com/workos/authkit-session/releases/tag/v0.5.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-session/releases/tag/v0.5.1"
}
],
"source": {
"advisory": "GHSA-vvvv-983w-r7pv",
"discovery": "UNKNOWN"
},
"title": "@workos/authkit-session: Open Redirect via state-derived redirect target"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42565",
"datePublished": "2026-05-11T19:01:28.340Z",
"dateReserved": "2026-04-28T17:26:12.084Z",
"dateUpdated": "2026-05-12T16:30:33.422Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-64762 (GCVE-0-2025-64762)
Vulnerability from cvelistv5 – Published: 2025-11-21 01:29 – Updated: 2025-11-24 18:09
VLAI
Title
authkit-nextjs may let session cookies be cached in CDNs
Summary
The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users. Next.js applications deployed on Vercel are unaffected unless they manually enable CDN caching by setting cache headers on authenticated paths. Patched in authkit-nextjs 2.11.1, which applies anti-caching headers to all responses behind authentication.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-524 - Use of Cache Containing Sensitive Information
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/workos/authkit-nextjs/security… | x_refsource_CONFIRM |
| https://github.com/workos/authkit-nextjs/commit/9… | x_refsource_MISC |
| https://github.com/workos/authkit-nextjs/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| workos | authkit-nextjs |
Affected:
< 2.11.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-64762",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-24T17:03:08.522780Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-24T18:09:43.225Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "authkit-nextjs",
"vendor": "workos",
"versions": [
{
"status": "affected",
"version": "\u003c 2.11.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS \u0026 AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users. Next.js applications deployed on Vercel are unaffected unless they manually enable CDN caching by setting cache headers on authenticated paths. Patched in authkit-nextjs 2.11.1, which applies anti-caching headers to all responses behind authentication."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-524",
"description": "CWE-524: Use of Cache Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-21T01:29:22.606Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/workos/authkit-nextjs/security/advisories/GHSA-p8pf-44ff-93gf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/workos/authkit-nextjs/security/advisories/GHSA-p8pf-44ff-93gf"
},
{
"name": "https://github.com/workos/authkit-nextjs/commit/94cf438124993abb0e7c19dac64c3cb5724a15ea",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-nextjs/commit/94cf438124993abb0e7c19dac64c3cb5724a15ea"
},
{
"name": "https://github.com/workos/authkit-nextjs/releases/tag/v2.11.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-nextjs/releases/tag/v2.11.1"
}
],
"source": {
"advisory": "GHSA-p8pf-44ff-93gf",
"discovery": "UNKNOWN"
},
"title": "authkit-nextjs may let session cookies be cached in CDNs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-64762",
"datePublished": "2025-11-21T01:29:22.606Z",
"dateReserved": "2025-11-10T22:29:34.876Z",
"dateUpdated": "2025-11-24T18:09:43.225Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-55008 (GCVE-0-2025-55008)
Vulnerability from cvelistv5 – Published: 2025-08-09 02:02 – Updated: 2025-08-11 14:33
VLAI
Title
AuthKit React Router: Sensitive auth data rendered in HTML
Summary
The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router. In versions 0.6.1 and below, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically sealedSession and accessToken by returning them from the authkitLoader. This caused them to be rendered into the browser HTML. This issue is fixed in version 0.7.0.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/workos/authkit-react-router/se… | x_refsource_CONFIRM |
| https://github.com/workos/authkit-react-router/co… | x_refsource_MISC |
| https://github.com/workos/authkit-react-router/re… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| workos | authkit-react-router |
Affected:
< 0.7.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-55008",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-11T14:32:24.190307Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-11T14:33:33.678Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "authkit-react-router",
"vendor": "workos",
"versions": [
{
"status": "affected",
"version": "\u003c 0.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS \u0026 AuthKit with React Router. In versions 0.6.1 and below, @workos-inc/authkit-react-router exposed sensitive authentication artifacts \u2014 specifically sealedSession and accessToken by returning them from the authkitLoader. This caused them to be rendered into the browser HTML. This issue is fixed in version 0.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-09T02:02:14.950Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/workos/authkit-react-router/security/advisories/GHSA-vqvc-9q8x-vmq6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/workos/authkit-react-router/security/advisories/GHSA-vqvc-9q8x-vmq6"
},
{
"name": "https://github.com/workos/authkit-react-router/commit/607caac658784962bab76e227f9c5820d0b9a9e5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-react-router/commit/607caac658784962bab76e227f9c5820d0b9a9e5"
},
{
"name": "https://github.com/workos/authkit-react-router/releases/tag/v0.7.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-react-router/releases/tag/v0.7.0"
}
],
"source": {
"advisory": "GHSA-vqvc-9q8x-vmq6",
"discovery": "UNKNOWN"
},
"title": "AuthKit React Router: Sensitive auth data rendered in HTML"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-55008",
"datePublished": "2025-08-09T02:02:14.950Z",
"dateReserved": "2025-08-04T17:34:24.422Z",
"dateUpdated": "2025-08-11T14:33:33.678Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-55009 (GCVE-0-2025-55009)
Vulnerability from cvelistv5 – Published: 2025-08-09 02:02 – Updated: 2025-08-11 14:35
VLAI
Title
AuthKit: Sensitive auth data rendered in HTML
Summary
The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In versions 0.14.1 and below, @workos-inc/authkit-remix exposed sensitive authentication artifacts — specifically sealedSession and accessToken — by returning them from the authkitLoader. This caused them to be rendered into the browser HTML.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/workos/authkit-remix/security/… | x_refsource_CONFIRM |
| https://github.com/workos/authkit-remix/commit/20… | x_refsource_MISC |
| https://github.com/workos/authkit-remix/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| workos | authkit-remix |
Affected:
< 0.15.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-55009",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-11T14:35:41.842990Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-11T14:35:52.345Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "authkit-remix",
"vendor": "workos",
"versions": [
{
"status": "affected",
"version": "\u003c 0.15.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS \u0026 AuthKit with Remix. In versions 0.14.1 and below, @workos-inc/authkit-remix exposed sensitive authentication artifacts \u2014 specifically sealedSession and accessToken \u2014 by returning them from the authkitLoader. This caused them to be rendered into the browser HTML."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-09T02:02:07.611Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/workos/authkit-remix/security/advisories/GHSA-v3gr-w9gf-23cx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/workos/authkit-remix/security/advisories/GHSA-v3gr-w9gf-23cx"
},
{
"name": "https://github.com/workos/authkit-remix/commit/20102afc74bf3dd5150a975a098067fb406b90b6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-remix/commit/20102afc74bf3dd5150a975a098067fb406b90b6"
},
{
"name": "https://github.com/workos/authkit-remix/releases/tag/v0.15.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-remix/releases/tag/v0.15.0"
}
],
"source": {
"advisory": "GHSA-v3gr-w9gf-23cx",
"discovery": "UNKNOWN"
},
"title": "AuthKit: Sensitive auth data rendered in HTML"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-55009",
"datePublished": "2025-08-09T02:02:07.611Z",
"dateReserved": "2025-08-04T17:34:24.422Z",
"dateUpdated": "2025-08-11T14:35:52.345Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-23017 (GCVE-0-2025-23017)
Vulnerability from cvelistv5 – Published: 2025-02-24 00:00 – Updated: 2025-02-24 16:01 Exclusively Hosted Service
VLAI
Summary
WorkOS Hosted AuthKit before 2025-01-07 allows a password authentication MFA bypass (by enrolling a new authentication factor) when the attacker knows the user's password. No exploitation occurred.
Severity
6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-305 - Authentication Bypass by Primary Weakness
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WorkOS | Hosted AuthKit |
Affected:
0 , < 2025-01-07
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-23017",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-24T16:01:14.574929Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-24T16:01:35.824Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Hosted AuthKit",
"vendor": "WorkOS",
"versions": [
{
"lessThan": "2025-01-07",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "WorkOS Hosted AuthKit before 2025-01-07 allows a password authentication MFA bypass (by enrolling a new authentication factor) when the attacker knows the user\u0027s password. No exploitation occurred."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305 Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-24T15:21:20.843Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://workos.com/security/advisories"
},
{
"url": "https://www.authkit.com"
}
],
"tags": [
"exclusively-hosted-service"
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-23017",
"datePublished": "2025-02-24T00:00:00.000Z",
"dateReserved": "2025-01-10T00:00:00.000Z",
"dateUpdated": "2025-02-24T16:01:35.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-51752 (GCVE-0-2024-51752)
Vulnerability from cvelistv5 – Published: 2024-11-05 19:16 – Updated: 2024-11-05 20:15
VLAI
Title
Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-nextjs
Summary
The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In affected versions refresh tokens are logged to the console when the disabled by default `debug` flag, is enabled. This issue has been patched in version 0.13.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/workos/authkit-nextjs/security… | x_refsource_CONFIRM |
| https://github.com/workos/authkit-nextjs/commit/1… | x_refsource_MISC |
| https://github.com/workos/authkit-nextjs/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| workos | authkit-nextjs |
Affected:
< 0.13.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-51752",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-05T20:14:57.346838Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T20:15:07.923Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "authkit-nextjs",
"vendor": "workos",
"versions": [
{
"status": "affected",
"version": "\u003c 0.13.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS \u0026 AuthKit with Next.js. In affected versions refresh tokens are logged to the console when the disabled by default `debug` flag, is enabled. This issue has been patched in version 0.13.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532: Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T19:16:41.831Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/workos/authkit-nextjs/security/advisories/GHSA-5wmg-9cvh-qw25",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/workos/authkit-nextjs/security/advisories/GHSA-5wmg-9cvh-qw25"
},
{
"name": "https://github.com/workos/authkit-nextjs/commit/15a332632f7560b03cc6d8cc8da24fd2ac931da7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-nextjs/commit/15a332632f7560b03cc6d8cc8da24fd2ac931da7"
},
{
"name": "https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2"
}
],
"source": {
"advisory": "GHSA-5wmg-9cvh-qw25",
"discovery": "UNKNOWN"
},
"title": "Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-nextjs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-51752",
"datePublished": "2024-11-05T19:16:41.831Z",
"dateReserved": "2024-10-31T14:12:45.791Z",
"dateUpdated": "2024-11-05T20:15:07.923Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-51753 (GCVE-0-2024-51753)
Vulnerability from cvelistv5 – Published: 2024-11-05 19:14 – Updated: 2024-11-05 20:16
VLAI
Title
Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-remix
Summary
The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In affected versions refresh tokens are logged to the console when the disabled by default `debug` flag, is enabled. This issue has been patched in version 0.4.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/workos/authkit-remix/security/… | x_refsource_CONFIRM |
| https://github.com/workos/authkit-remix/commit/32… | x_refsource_MISC |
| https://github.com/workos/authkit-remix/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| workos | authkit-remix |
Affected:
< 0.4.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-51753",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-05T20:15:29.247219Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T20:16:29.928Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "authkit-remix",
"vendor": "workos",
"versions": [
{
"status": "affected",
"version": "\u003c 0.4.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS \u0026 AuthKit with Remix. In affected versions refresh tokens are logged to the console when the disabled by default `debug` flag, is enabled. This issue has been patched in version 0.4.1. All users are advised to upgrade. There are no known workarounds for this vulnerability."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532: Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T19:14:47.097Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/workos/authkit-remix/security/advisories/GHSA-v2qh-f584-6hj8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/workos/authkit-remix/security/advisories/GHSA-v2qh-f584-6hj8"
},
{
"name": "https://github.com/workos/authkit-remix/commit/32d5bcd54c795c1e2a3204f8e3977ab9ad57ec06",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-remix/commit/32d5bcd54c795c1e2a3204f8e3977ab9ad57ec06"
},
{
"name": "https://github.com/workos/authkit-remix/releases/tag/v0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-remix/releases/tag/v0.4.1"
}
],
"source": {
"advisory": "GHSA-v2qh-f584-6hj8",
"discovery": "UNKNOWN"
},
"title": "Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-remix"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-51753",
"datePublished": "2024-11-05T19:14:47.097Z",
"dateReserved": "2024-10-31T14:12:45.791Z",
"dateUpdated": "2024-11-05T20:16:29.928Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-29901 (GCVE-0-2024-29901)
Vulnerability from cvelistv5 – Published: 2024-03-29 15:23 – Updated: 2024-08-02 01:17
VLAI
Title
@workos-inc/authkit-nextjs session replay vulnerability
Summary
The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js.
A user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-294 - Authentication Bypass by Capture-replay
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/workos/authkit-nextjs/security… | x_refsource_CONFIRM |
| https://github.com/workos/authkit-nextjs/commit/6… | x_refsource_MISC |
| https://github.com/workos/authkit-nextjs/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| workos | authkit-nextjs |
Affected:
< 0.4.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-29901",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-08T18:05:37.365811Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-08T20:06:40.754Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:17:58.024Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/workos/authkit-nextjs/security/advisories/GHSA-35w3-6qhc-474v",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/workos/authkit-nextjs/security/advisories/GHSA-35w3-6qhc-474v"
},
{
"name": "https://github.com/workos/authkit-nextjs/commit/6c3f4f3179d66cbb15de3962792083ff3b244a01",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/workos/authkit-nextjs/commit/6c3f4f3179d66cbb15de3962792083ff3b244a01"
},
{
"name": "https://github.com/workos/authkit-nextjs/releases/tag/v0.4.2",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/workos/authkit-nextjs/releases/tag/v0.4.2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "authkit-nextjs",
"vendor": "workos",
"versions": [
{
"status": "affected",
"version": "\u003c 0.4.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS \u0026 AuthKit with Next.js.\nA user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-294",
"description": "CWE-294: Authentication Bypass by Capture-replay",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-29T15:23:02.184Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/workos/authkit-nextjs/security/advisories/GHSA-35w3-6qhc-474v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/workos/authkit-nextjs/security/advisories/GHSA-35w3-6qhc-474v"
},
{
"name": "https://github.com/workos/authkit-nextjs/commit/6c3f4f3179d66cbb15de3962792083ff3b244a01",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-nextjs/commit/6c3f4f3179d66cbb15de3962792083ff3b244a01"
},
{
"name": "https://github.com/workos/authkit-nextjs/releases/tag/v0.4.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/workos/authkit-nextjs/releases/tag/v0.4.2"
}
],
"source": {
"advisory": "GHSA-35w3-6qhc-474v",
"discovery": "UNKNOWN"
},
"title": "@workos-inc/authkit-nextjs session replay vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-29901",
"datePublished": "2024-03-29T15:23:02.184Z",
"dateReserved": "2024-03-21T15:12:09.000Z",
"dateUpdated": "2024-08-02T01:17:58.024Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}