Products
AuthKit
Complete auth & user management platform
Enterprise SSO
Unified SSO integration for any identity provider
Radar
Real-time protection against bots, fraud, and abuse
MCP Auth
Secure auth for MCP servers
Directory Sync
User lifecycle management from corporate directories
Role-Based Access Control
Powerful and flexible permissions for your users
Multi-Factor Authentication
Advanced auth methods
Admin Portal
Self-serve onboarding for corporate IT admins
FGA
Fine-grained authorization for any resource in your app
auth.md
User registration for agents
Audit Logs
Event logging, exporting, and streaming
Vault
EKM for encrypting and optionally storing objects
Passport
One sign-in for every app and agent
Airlock
Intent-Based Access Control
Pipes
Integrations for your apps & agents
Docs
Customers
Resources
Changelog
Blog
Guides
Podcast
Company
Careers
Security
Support Plans
Customers
Pricing
Pricing
Sign in
Dashboard
Copy logo as SVG
Copy brandmark as SVG
Download brand kit
Products
AuthKit
Complete auth & user management platform
Enterprise SSO
Unified SSO integration for any identity provider
Radar
Real-time protection against bots, fraud, and abuse
MCP Auth
Secure auth for MCP servers
Directory Sync
User lifecycle management from corporate directories
Role-Based Access Control
Powerful and flexible permissions for your users
Multi-Factor Authentication
Advanced auth methods
Admin Portal
Self-serve onboarding for corporate IT admins
FGA
Fine-grained authorization for any resource in your app
auth.md
User registration for agents
Audit Logs
Event logging, exporting, and streaming
Vault
EKM for encrypting and optionally storing objects
Passport
One sign-in for every app and agent
Airlock
Intent-Based Access Control
Pipes
Integrations for your apps & agents
Developers
Documentation
Changelog
API Status
Resources
Changelog
Blog
Guides
Podcast
Company
Careers
Security
Support Plans
Customers
Pricing
Sign in
Sign up

Security bulletins

Last updated
January 13, 2025

Password Authentication MFA Bypass in Hosted AuthKit (CVE-2025-23017)

A high-severity MFA bypass affected Hosted AuthKit users with password authentication and MFA enabled. It was fixed on January 7, 2025 and never exploited; no action is required.

Last updated
November 2, 2026

October 30th, 2026 Data Security Incident

We are investigating unauthorized access to an internal tool used by our sales and customer-facing teams. This update explains our response and observations on AI-assisted attacks.

Products
AuthKitEnterprise SSODirectory SyncAdmin PortalAudit LogsMulti-Factor AuthenticationRole-Based Access ControlRadarVaultPipesAirlockauth.mdPassport
Developers
DocumentationChangelogAPI Status
Resources
BlogGuidesPodcastPricingStartupsSupport PlansEnterprise SLA
Company
AboutCustomersCareersSecurityLegalTrust CenterContact
© WorkOS, Inc.

We use cookies for analytics and advertising. See our cookie policy for details.