WorkOS vulnerabilities
We track 4 vulnerabilities in WorkOS products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on November 21, 2025.
Latest WorkOS vulnerabilities
- 9.1 Critical severity
authkit-nextjs: Use of Cache Containing Sensitive Information
The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In env
- 7.1 High severity
authkit-remix: Exposure of Sensitive Information to an Unauthorized Actor
The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In versions 0.14.1 and below, @workos-inc/authkit-remix exposed sensitive authentication artifacts — specifically sealedSessi
- 7.1 High severity
authkit-react-router: Exposure of Sensitive Information to an Unauthorized Actor
The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router. In versions 0.6.1 and below, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically
- 8.1 High severity
authkit-nextjs: Authentication Bypass by Capture-replay
The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js. A user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2.