Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS01d21nLTljdmgtcXcyNc4ABA_R

@workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled

Impact

Refresh tokens are logged to the console when the disabled by default debug flag, is enabled.

Patches

Patched in https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2

Permalink: https://github.com/advisories/GHSA-5wmg-9cvh-qw25
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01d21nLTljdmgtcXcyNc4ABA_R
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: about 2 months ago
Updated: about 2 months ago

EPSS Percentage: 0.00045
EPSS Percentile: 0.1735

Identifiers: GHSA-5wmg-9cvh-qw25, CVE-2024-51752
References:

• https://github.com/workos/authkit-nextjs/security/advisories/GHSA-5wmg-9cvh-qw25
• https://github.com/workos/authkit-nextjs/commit/15a332632f7560b03cc6d8cc8da24fd2ac931da7
• https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2
• https://nvd.nist.gov/vuln/detail/CVE-2024-51752
• https://github.com/advisories/GHSA-5wmg-9cvh-qw25

Repository: https://github.com/workos/authkit-nextjs
Blast Radius: 1.0

Affected Packages