Kinde - Notice history

Post-incident report now available.

Following the incident of 3 September 2025, we've now prepared a post-incident report, containing detailed information about the root cause, remedies, future actions, etc.

View post-incident report.

If you have any questions, or need any additional information, please reach out to us by email, or in our Slack and Discord communities. We're here to support you however we can.
Again, we are deeply apologetic for the inconvenience caused to you and your customers. We are making it impossible to happen again.

A brief update to the summary from yesterday.

Incident window on September 3 between 10:40am to 11:41am Sydney time (12:40am to 01:41am UTC).

This was not a malicious attack and there was no Kinde data breach from an external attacker. We caused it.

The deployment was rolled back 61 minutes after the bug appeared, fixing the issue. Users who logged in outside of the incident window are not affected.

Only OAuth and OIDC type connections were impacted, such as all social authentication connections and the Entra OAuth enterprise connection.

Email, username, SMS, and SAML connections were not impacted.

There was no cross-business profile exposure.

For each of your OAuth2 or OIDC connections, the first user to authenticate during the incident window became the profile for subsequent users on that OAuth2 or OIDC connection.

For example, say user 1 authenticated at the beginning of the incident. When any subsequent user authenticated (e.g. user 2, 3, and 4) they were shown the profile for user 1.

Less than 100 user profiles globally were exposed by this incident.

Sessions and tokens during the incident window were identified and invalidated by the evening of Sep 3 Sydney time.

The Kinde team are actively reaching out directly to impacted Kinde businesses who have had authentication sessions during the incident window to provide further information and assistance.

We will be closing this incident on the status page, however updates will still be provided here publicly and directly to customers where required.

Only users who logged in during the hour long incident window were impacted.

The initial bug from this morning was resolved. All impacted sessions and tokens for the Kinde admin have been invalidated. Additionally all customer sessions during the incident window have been invalidated on the Kinde side.

We are compiling a list of users impacted and will be reaching out directly to customers to verify if there are any cached access or refresh tokens that need to be invalidated.

The team are continuing to investigate the total breadth of the incident, specifically with the invalidation of logins during the incident. We will continue to update this status page with high level information and directly to customers for information specific to their business.

Sydney region is operational and user sessions are in the process of being invalidated.

There is high latency for the Sydney region currently.

We are currently working on invalidating all sessions that took place during the incident.

We implemented a fix that resolves the issue and are currently monitoring the result. This is being treated as a serious incident and our team is working urgently.

We have identified a critical authentication error affecting Social SSO, email and SMS.

Enterprise Connections/SSO are not affected.