« Volver al listado

CVE-2025-23017

Estado: AplazadaMedia (6)—

WorkOS Hosted AuthKit before 2025-01-07 allows a password authentication MFA bypass (by enrolling a new authentication factor) when the attacker knows the user's password. No exploitation occurred.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Workos — Hosted AuthkitAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-23017",
  "cveTags": [
    {
      "tags": [
        "exclusively-hosted-service"
      ],
      "sourceIdentifier": "cve@mitre.org"
    }
  ],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-23017",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-24T16:01:14.574929Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.7,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "WorkOS",
          "product": "Hosted AuthKit",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2025-01-07",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-02-24T15:15:13.393",
  "references": [
    {
      "url": "https://workos.com/security/advisories",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.authkit.com",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-305"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "WorkOS Hosted AuthKit before 2025-01-07 allows a password authentication MFA bypass (by enrolling a new authentication factor) when the attacker knows the user's password. No exploitation occurred."
    },
    {
      "lang": "es",
      "value": " WorkOS Hosted AuthKit anterior al 7 de enero de 2025 permite omitir la autenticación de contraseñas mediante MFA (mediante el registro de un nuevo factor de autenticación) cuando el atacante conoce la contraseña del usuario. No se produjo ninguna explotación."
    }
  ],
  "lastModified": "2026-06-17T08:51:27.490",
  "sourceIdentifier": "cve@mitre.org"
}