{"id":"INC-workos-mtxlm37kp39x","kind":"incident","aliases":[],"related":[],"title":"WorkOS: Elevated latency and errors for SSO sign-in","description":"From 09:48 to 09:53 UTC on November 13, 2026, SSO sign-in requests were slow, and a small number failed with HTTP 500 errors or 408 timeouts. The slowdown affected SSO authorization, identity provider callbacks and token exchange.","summary":"WorkOS had a five-minute incident in which SSO sign-in requests were slow and a small number failed with HTTP 500 or 408 errors. It was an availability problem, with no sign that data was exposed or accessed.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WorkOS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["incident","saas","security","sso","vendor","workos"],"not_affected_if":["no-workos-sso"],"how_to_check":null,"fix":null,"status":"resolved","published_at":"2026-11-13T09:30:00+00:00","first_seen_at":"2026-11-13T17:19:33+00:00","triaged_at":"2026-11-13T17:21:17+00:00","updated_at":"2026-11-13T17:21:17+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-13T17:21:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WorkOS: five-minute SSO sign-in slowdown and errors, now resolved","impact":"low","summary":"WorkOS had a five-minute incident in which SSO sign-in requests were slow and a small number failed with HTTP 500 or 408 errors. It was an availability problem, with no sign that data was exposed or accessed.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["workos","sso","saas"],"confidence":0.6,"fix_status":"none","needs_auth":"no","worst_case":"SSO sign-ins slow or fail for a few minutes","analyst_note":"","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-workos-sso"],"who_is_affected":"Companies that let staff sign in to their apps through WorkOS-powered SSO may have seen failed or slow logins between 09:48 and 09:53 UTC on November 13, 2026. The incident is resolved and the sources describe no action for customers.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000654,"input_tokens":4534,"output_tokens":402,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'09':63C,66C '13':71C '2026':72C '408':46B,90C '48':64C '500':44B,87C '53':67C 'access':61B 'affect':94C 'author':96C 'avail':51B 'callback':99C 'data':57B 'elev':2A 'error':5A,47B,88C 'exchang':102C 'expos':59B 'fail':41B,84C 'five':25B 'five-minut':24B 'http':43B,86C 'ident':97C 'inc':11A 'inc-workos-mtxlm37kp39x':10A 'incid':15B,27B 'latenc':3A 'minut':26B 'mtxlm37kp39x':13A 'novemb':70C 'number':40B,83C 'problem':52B 'provid':98C 'request':34B,77C 'saa':16B 'secur':17B 'sign':9A,32B,55B,75C 'sign-in':8A,31B,74C 'slow':36B,79C 'slowdown':93C 'small':39B,82C 'sso':7A,18B,30B,73C,95C 'timeout':91C 'token':101C 'utc':68C 'vendor':19B 'worko':1A,20B,21B 'workos':12A,14A","nicknames":[],"mitigations":[],"who_affected":"Companies that let staff sign in to their apps through WorkOS-powered SSO may have seen failed or slow logins between 09:48 and 09:53 UTC on November 13, 2026. The incident is resolved and the sources describe no action for customers.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["workos"],"ptokens":["workos"],"labels":["incident","low","saas","security","sso","vendor","workos"],"campaign_type":null,"search_a":"'elev':2A 'error':5A 'inc':11A 'inc-workos-mtxlm37kp39x':10A 'latenc':3A 'mtxlm37kp39x':13A 'sign':9A 'sign-in':8A 'sso':7A 'worko':1A 'workos':12A,14A","search_b":"'408':46B '500':44B 'access':61B 'avail':51B 'data':57B 'error':47B 'expos':59B 'fail':41B 'five':25B 'five-minut':24B 'http':43B 'incid':15B,27B 'minut':26B 'number':40B 'problem':52B 'request':34B 'saa':16B 'secur':17B 'sign':32B,55B 'sign-in':31B 'slow':36B 'small':39B 'sso':18B,30B 'vendor':19B 'worko':20B,21B","search_c":"'09':63C,66C '13':71C '2026':72C '408':90C '48':64C '500':87C '53':67C 'affect':94C 'author':96C 'callback':99C 'error':88C 'exchang':102C 'fail':84C 'http':86C 'ident':97C 'novemb':70C 'number':83C 'provid':98C 'request':77C 'sign':75C 'sign-in':74C 'slow':79C 'slowdown':93C 'small':82C 'sso':73C,95C 'timeout':91C 'token':101C 'utc':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T09:30:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"statuspage","external_id":"workos:mtxlm37kp39x","url":"https://stspg.io/zj6c046ffm05","severity":"low","published_at":"2026-11-13T09:30:00+00:00","modified_at":"2026-11-13T17:19:05+00:00","first_seen_at":"2026-11-13T17:19:33+00:00","fetched_at":"2026-11-13T19:06:25+00:00","note":null}],"documents":[],"disclosures":[{"company":"WorkOS","domain":"workos.com","url":"https://workos.com/security/bulletins/update-for-october-30th-2026-data-security-incident","kind":"blog","published_at":"2026-11-06T00:00:00+00:00","quote":"We've identified the source of the unauthorized access to our internal tool: a security researcher whose AI agent escaped its testing environment.","confidence":0.949999988079071,"source":"model","created_at":"2026-11-08T16:43:10+00:00","entry":"exposed-secret"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}