CVE-2024-51752lowCWE-532

CVE-2024-51752: falha de baixa gravidade em workos authkit-nextjs

Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-nextjs

Publicada em

Seguir esta CVE+ Monitorar authkit-nextjs+ Monitorar @workos-inc/authkit-nextjs

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2.1epss 0.2%
The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In affected versions refresh tokens are logged to the console when the disabled by default `debug` flag, is enabled. This issue has been patched in version 0.13.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
workos · authkit-nextjs
CVEs relacionadas — workos authkit-nextjs

No mesmo produto, das mais perigosas para as menos.

CVE-2024-29901MEDIUM@workos-inc/authkit-nextjs session replay vulnerabilityEPSS 0.7%CVE-2025-64762HIGHauthkit-nextjs may let session cookies be cached in CDNsEPSS 0.4%