CVE-2024-51752: WorkOS AuthKit Next.js sensitive token logging in debug mode

CVE-2024-51752 · Severity: medium · CVSS 4 · Published 2024-11-05

The WorkOS AuthKit library for Next.js, used to manage user authentication and sessions, logs sensitive refresh tokens to the console when a debug flag is enabled. While this flag is off by default, developers who turn it on for troubleshooting could expose authentication credentials in application logs, potentially allowing unauthorized access to user accounts. The vulnerability has been patched in version 0.13.2.

Technologies: @workos-inc/authkit-nextjs (npm). Vendors: npm, WorkOS.

Quick answers

Is CVE-2024-51752 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-51752 being exploited in the wild.
How severe is CVE-2024-51752?
Medium severity, with a CVSS score of 4, published 5 November 2024.
Which products and versions are affected?
@workos-inc/authkit-nextjs (npm) SEMVER:introduced=0,fixed=0.13.2; WorkOS AuthKit < 0.13.2.
Is there a fix for CVE-2024-51752?
Yes. @workos-inc/authkit-nextjs (npm): upgrade to 0.13.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-51752 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2024-51752?
Check whether you run @workos-inc/authkit-nextjs (npm) or WorkOS AuthKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @workos-inc/authkit-nextjs (npm): upgrade to 0.13.2 or later
    npm install @workos-inc/authkit-nextjs@0.13.2

Technical details

The vulnerability is classified as information disclosure (CWE-532). When the debug flag (disabled by default) is explicitly enabled by a developer or administrator, the library logs refresh tokens to the console output. This is an implementation flaw where sensitive tokens should never be logged, regardless of debug settings. The attack vector requires local access to application logs and the debug flag to be explicitly enabled, reducing immediate risk but creating a configuration-based exposure vector. An attacker with access to console logs or log aggregation systems could extract valid refresh tokens and use them to forge authenticated sessions. The fix, released in version 0.13.2, updated the logging strategy to exclude sensitive tokens from debug output.

Affected products

  • WorkOS @workos-inc/authkit-nextjs < 0.13.2

Identifiers

  • CVE-2024-51752
  • GHSA-5wmg-9cvh-qw25

Timeline

  • 2024-11-05: disclosed: GHSA-5wmg-9cvh-qw25 published
  • 2024-11-04: patched: Patched in v0.13.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.