CVE-2024-51753CWE-532

Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-remix

Low · published November 5, 2024

CVSS v4.0
2.1
EPSS
0%
Percentile
11.5
In the wild
Unconfirmed
What it is

The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In affected versions refresh tokens are logged to the console when the disabled by default `debug` flag, is enabled. This issue has been patched in version 0.4.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v4.0
2.1 · LOW
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00217 · 11.5th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2024-11-05T19:14Z
EPSS history
Timeline
  • 05 NOV 19:14Z
    Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-remix
    cvelistv5