@workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled

MEDIO 5.5CVE-2024-51752 · GHSA-5wmg-9cvh-qw25 · Published 05/11/2024 · updated 17/06/2026

En resumen

CVE-2024-51752 es una vulnerabilidad MEDIO (CVSS 5.5) que afecta a authkit-nextjs (workos), @workos-inc/authkit-nextjs.
Probabilidad de explotación en los próximos 30 días (EPSS): 0.25%, mayor que el 15.9% de las vulnerabilidades.
Solución: actualizar a 0.13.2 o posterior.

Package	Affected versions	Patched versions
authkit-nextjs workos	`< 0.13.2`	`0.13.2`
@workos-inc/authkit-nextjs npm	`< 0.13.2`	`0.13.2`

Description

Impact

Refresh tokens are logged to the console when the disabled by default debug flag, is enabled.

Patches

Patched in https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2

NVD description

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In affected versions refresh tokens are logged to the console when the disabled by default `debug` flag, is enabled. This issue has been patched in version 0.13.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

References

workos/authkit-nextjs security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-51752 · ADVISORY
workos/authkit-nextjs commit 15a3326 · WEB
workos/authkit-nextjs · PACKAGE
workos/authkit-nextjs release v0.13.2 · WEB

Más vulnerabilidades de authkit-nextjs

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

authkit-nextjs

workos

< 0.13.2

0.13.2

@workos-inc/authkit-nextjs

npm

< 0.13.2

0.13.2

Description

Impact

Refresh tokens are logged to the console when the disabled by default debug flag, is enabled.

Patches

Patched in https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2

NVD description

Más vulnerabilidades de authkit-nextjs

Ver todo →