@workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled

MITTEL 5.5CVE-2024-51752 · GHSA-5wmg-9cvh-qw25 · Published 05/11/2024 · updated 17/06/2026

Kurz gesagt

CVE-2024-51752 ist eine Schwachstelle (MITTEL (CVSS 5.5)) in authkit-nextjs (workos), @workos-inc/authkit-nextjs.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.25%, höher als bei 15.9% aller Schwachstellen.
Abhilfe: auf 0.13.2 oder neuer aktualisieren.

Package	Affected versions	Patched versions
authkit-nextjs workos	`< 0.13.2`	`0.13.2`
@workos-inc/authkit-nextjs npm	`< 0.13.2`	`0.13.2`

Description

Impact

Refresh tokens are logged to the console when the disabled by default debug flag, is enabled.

Patches

Patched in https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2

NVD description

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In affected versions refresh tokens are logged to the console when the disabled by default `debug` flag, is enabled. This issue has been patched in version 0.13.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

References

workos/authkit-nextjs security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-51752 · ADVISORY
workos/authkit-nextjs commit 15a3326 · WEB
workos/authkit-nextjs · PACKAGE
workos/authkit-nextjs release v0.13.2 · WEB

Weitere Schwachstellen in authkit-nextjs

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

authkit-nextjs

workos

< 0.13.2

0.13.2

@workos-inc/authkit-nextjs

npm

< 0.13.2

0.13.2

Description

Impact

Refresh tokens are logged to the console when the disabled by default debug flag, is enabled.

Patches

Patched in https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2

NVD description

Weitere Schwachstellen in authkit-nextjs

Alle anzeigen →