{"id":"INC-workos-5fy1qdlgth9n","kind":"incident","aliases":[],"related":[],"title":"WorkOS: Elevated errors on AuthKit authentication endpoints","description":"On August 18 from 23:59 to 00:03 UTC (August 19), a subset of API requests (primarily AuthKit authentication endpoints) returned HTTP 500 errors. Automatic maintenance of a large, seldom-used internal index caused brief write-ahead-log contention on a primary database that exhausted connection capacity; service recovered automatically within four minutes. We identified the root cause and removed the index from production at 03:53 UTC on August 19 to prevent recurrence.","summary":null,"severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WorkOS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["incident","ops","vendor","workos"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"resolved","published_at":"2026-08-19T00:00:00+00:00","first_seen_at":"2026-11-08T16:43:27+00:00","triaged_at":"2026-11-08T16:44:18+00:00","updated_at":"2026-11-08T16:44:18+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'00':24C '03':25C,85C '18':19C '19':28C,90C '23':21C '500':40C '53':86C '59':22C '5fy1qdlgth9n':11A 'ahead':56C 'api':32C 'august':18C,27C,89C 'authent':6A,36C 'authkit':5A,35C 'automat':42C,69C 'brief':53C 'capac':66C 'caus':52C,77C 'connect':65C 'content':58C 'databas':62C 'elev':2A 'endpoint':7A,37C 'error':3A,41C 'exhaust':64C 'four':71C 'http':39C 'identifi':74C 'inc':9A 'inc-workos-5fy1qdlgth9n':8A 'incid':13B 'index':51C,81C 'intern':50C 'larg':46C 'log':57C 'mainten':43C 'minut':72C 'op':14B 'prevent':92C 'primari':61C 'primarili':34C 'product':83C 'recov':68C 'recurr':93C 'remov':79C 'request':33C 'return':38C 'root':76C 'seldom':48C 'seldom-us':47C 'servic':67C 'subset':30C 'use':49C 'utc':26C,87C 'vendor':15B 'within':70C 'worko':1A,16B 'workos':10A,12A 'write':55C 'write-ahead-log':54C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["workos"],"ptokens":["workos"],"labels":["incident","low","ops","vendor","workos"],"campaign_type":null,"search_a":"'5fy1qdlgth9n':11A 'authent':6A 'authkit':5A 'elev':2A 'endpoint':7A 'error':3A 'inc':9A 'inc-workos-5fy1qdlgth9n':8A 'worko':1A 'workos':10A,12A","search_b":"'incid':13B 'op':14B 'vendor':15B 'worko':16B","search_c":"'00':24C '03':25C,85C '18':19C '19':28C,90C '23':21C '500':40C '53':86C '59':22C 'ahead':56C 'api':32C 'august':18C,27C,89C 'authent':36C 'authkit':35C 'automat':42C,69C 'brief':53C 'capac':66C 'caus':52C,77C 'connect':65C 'content':58C 'databas':62C 'endpoint':37C 'error':41C 'exhaust':64C 'four':71C 'http':39C 'identifi':74C 'index':51C,81C 'intern':50C 'larg':46C 'log':57C 'mainten':43C 'minut':72C 'prevent':92C 'primari':61C 'primarili':34C 'product':83C 'recov':68C 'recurr':93C 'remov':79C 'request':33C 'return':38C 'root':76C 'seldom':48C 'seldom-us':47C 'servic':67C 'subset':30C 'use':49C 'utc':26C,87C 'within':70C 'write':55C 'write-ahead-log':54C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-08-19T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"statuspage","external_id":"workos:5fy1qdlgth9n","url":"https://stspg.io/f6qft677v2kv","severity":"low","published_at":"2026-08-19T00:00:00+00:00","modified_at":"2026-08-19T18:14:28+00:00","first_seen_at":"2026-11-08T16:43:27+00:00","fetched_at":"2026-11-09T02:40:09+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}