logo

Database

Insecure session management In @workos-inc/authkit-nextjs

Description

@workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled

Impact

Refresh tokens are logged to the console when the disabled by default debug flag, is enabled.

Patches

Patched in https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2024-517522. NVD-2024-517523. OSV-2024-517524. GHSA-5wmg-9cvh-qw255. GCVE-2024-51752

References

1. https://github.com/workos/authkit-nextjs/security/advisories/GHSA-5wmg-9cvh-qw252. https://github.com/workos/authkit-nextjs/commit/15a332632f7560b03cc6d8cc8da24fd2ac931da73. https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.