CVE-2024-51752

Nov. 6, 2024, 6:17 p.m.

None
No Score

Description

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In affected versions refresh tokens are logged to the console when the disabled by default `debug` flag, is enabled. This issue has been patched in version 0.13.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Product(s) Impacted

Product Versions
AuthKit library for Next.js
  • 0.0.1 - 0.13.1

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-532
Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

References

https://github.com/workos/authkit-nextjs/commit/15a332632f7560b03cc6d8cc8da24fd2ac931da7
https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2
https://github.com/workos/authkit-nextjs/security/advisories/GHSA-5wmg-9cvh-qw25

Tags

security-advisories@github.com
CWE-532
2024-11-05
CVE-2024-51752

Timeline

Published: Nov. 5, 2024, 8:15 p.m.
Last Modified: Nov. 6, 2024, 6:17 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security-advisories@github.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.