@workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled

MÉDIO 5.5CVE-2024-51752 · GHSA-5wmg-9cvh-qw25 · Published 05/11/2024 · updated 17/06/2026

Em resumo

CVE-2024-51752 é uma vulnerabilidade MÉDIO (CVSS 5.5) que afeta authkit-nextjs (workos), @workos-inc/authkit-nextjs.
Chance de exploração nos próximos 30 dias (EPSS): 0.25%, maior que 15.9% das vulnerabilidades.
Correção: atualize para 0.13.2 ou posterior.

Package	Affected versions	Patched versions
authkit-nextjs workos	`< 0.13.2`	`0.13.2`
@workos-inc/authkit-nextjs npm	`< 0.13.2`	`0.13.2`

Description

Impact

Refresh tokens are logged to the console when the disabled by default debug flag, is enabled.

Patches

Patched in https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2

NVD description

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In affected versions refresh tokens are logged to the console when the disabled by default `debug` flag, is enabled. This issue has been patched in version 0.13.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

References

workos/authkit-nextjs security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-51752 · ADVISORY
workos/authkit-nextjs commit 15a3326 · WEB
workos/authkit-nextjs · PACKAGE
workos/authkit-nextjs release v0.13.2 · WEB

Mais vulnerabilidades de authkit-nextjs

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

authkit-nextjs

workos

< 0.13.2

0.13.2

@workos-inc/authkit-nextjs

npm

< 0.13.2

0.13.2

Description

Impact

Refresh tokens are logged to the console when the disabled by default debug flag, is enabled.

Patches

Patched in https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2

NVD description

Mais vulnerabilidades de authkit-nextjs

Ver tudo →