@workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled

MEDIUM 5.5CVE-2024-51752 · GHSA-5wmg-9cvh-qw25 · Published 05/11/2024 · updated 17/06/2026

In short

CVE-2024-51752 is a MEDIUM (CVSS 5.5) vulnerability affecting authkit-nextjs (workos), @workos-inc/authkit-nextjs.
Chance of exploitation in the next 30 days (EPSS): 0.25%, higher than 15.9% of all vulnerabilities.
Fix: update to 0.13.2 or later.

Package	Affected versions	Patched versions
authkit-nextjs workos	`< 0.13.2`	`0.13.2`
@workos-inc/authkit-nextjs npm	`< 0.13.2`	`0.13.2`

Description

Impact

Refresh tokens are logged to the console when the disabled by default debug flag, is enabled.

Patches

Patched in https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2

NVD description

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In affected versions refresh tokens are logged to the console when the disabled by default `debug` flag, is enabled. This issue has been patched in version 0.13.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

References

workos/authkit-nextjs security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-51752 · ADVISORY
workos/authkit-nextjs commit 15a3326 · WEB
workos/authkit-nextjs · PACKAGE
workos/authkit-nextjs release v0.13.2 · WEB

More vulnerabilities in authkit-nextjs

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

authkit-nextjs

workos

< 0.13.2

0.13.2

@workos-inc/authkit-nextjs

npm

< 0.13.2

0.13.2

Description

Impact

Refresh tokens are logged to the console when the disabled by default debug flag, is enabled.

Patches

Patched in https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2

NVD description

More vulnerabilities in authkit-nextjs

See all →