@workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled

MOYENNE 5.5CVE-2024-51752 · GHSA-5wmg-9cvh-qw25 · Published 05/11/2024 · updated 17/06/2026

En bref

CVE-2024-51752 est une vulnérabilité MOYENNE (CVSS 5.5) touchant authkit-nextjs (workos), @workos-inc/authkit-nextjs.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.25%, plus élevée que 15.9% des vulnérabilités.
Correctif : mettre à jour vers 0.13.2 ou plus récent.

Package	Affected versions	Patched versions
authkit-nextjs workos	`< 0.13.2`	`0.13.2`
@workos-inc/authkit-nextjs npm	`< 0.13.2`	`0.13.2`

Description

Impact

Refresh tokens are logged to the console when the disabled by default debug flag, is enabled.

Patches

Patched in https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2

NVD description

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In affected versions refresh tokens are logged to the console when the disabled by default `debug` flag, is enabled. This issue has been patched in version 0.13.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

References

workos/authkit-nextjs security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-51752 · ADVISORY
workos/authkit-nextjs commit 15a3326 · WEB
workos/authkit-nextjs · PACKAGE
workos/authkit-nextjs release v0.13.2 · WEB

Autres vulnérabilités de authkit-nextjs

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

authkit-nextjs

workos

< 0.13.2

0.13.2

@workos-inc/authkit-nextjs

npm

< 0.13.2

0.13.2

Description

Impact

Refresh tokens are logged to the console when the disabled by default debug flag, is enabled.

Patches

Patched in https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2

NVD description

Autres vulnérabilités de authkit-nextjs

Tout voir →