CVE-2024-51752CWE-532

Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-nextjs

Low · published November 5, 2024

CVSS v4.0
2.1
EPSS
0%
Percentile
14.9
In the wild
Unconfirmed
What it is

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In affected versions refresh tokens are logged to the console when the disabled by default `debug` flag, is enabled. This issue has been patched in version 0.13.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v4.0
2.1 · LOW
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00246 · 14.9th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2024-11-05T19:16Z
EPSS history
Timeline
  • 05 NOV 19:16Z
    Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-nextjs
    cvelistv5