CVE-2025-23017

MEDIUM EPSS 22.8%

Published Feb 24, 20251y ago · Modified Jun 17, 20262w ago

6.0 CVSS 3.1

Medium

Published Feb 24, 2025 1y ago

Last Modified Jun 17, 2026 2w ago

Description

WorkOS Hosted AuthKit before 2025-01-07 allows a password authentication MFA bypass (by enrolling a new authentication factor) when the attacker knows the user's password. No exploitation occurred.

CVSS Details

Base Score

6.0

Exploitability

1.8

Impact

3.7

Vector string

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

Attack Vector Network

Attack Complexity High

Privileges Required Low

User Interaction None

Scope Changed

Confidentiality Low

Integrity Low

Availability Low

Threat Intelligence

EPSS Exploit Probability

22.8% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-305

References 2

workos.com https://workos.com/security/advisories
authkit.com https://www.authkit.com

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.