Is CVE-2024-51753 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-51753 being exploited in the wild.

How severe is CVE-2024-51753?

Medium severity, with a CVSS score of 4, published 5 November 2024.

Which products and versions are affected?

@workos-inc/authkit-remix (npm) SEMVER:introduced=0,fixed=0.4.1; WorkOS Authkit-Remix before 0.4.1.

Is there a fix for CVE-2024-51753?

Yes. @workos-inc/authkit-remix (npm): upgrade to 0.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-51753 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2024-51753?

Check whether you run @workos-inc/authkit-remix (npm) or WorkOS Authkit-Remix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-51753: WorkOS authkit-remix sensitive information disclosure in debug logging

CVE-2024-51753 · Severity: medium · CVSS 4 · Published 2024-11-05

WorkOS authkit-remix is an authentication library used by developers to add login/logout functionality to Remix web applications. When a developer enables the debug flag in development/testing, refresh tokens (sensitive credentials used to obtain new access tokens) are exposed in console logs. An attacker with access to logs or console output could steal these tokens and impersonate users or access protected resources.

Vendors: npm, WorkOS.

Quick answers

Is CVE-2024-51753 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-51753 being exploited in the wild.
How severe is CVE-2024-51753?: Medium severity, with a CVSS score of 4, published 5 November 2024.
Which products and versions are affected?: @workos-inc/authkit-remix (npm) SEMVER:introduced=0,fixed=0.4.1; WorkOS Authkit-Remix before 0.4.1.
Is there a fix for CVE-2024-51753?: Yes. @workos-inc/authkit-remix (npm): upgrade to 0.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-51753 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2024-51753?: Check whether you run @workos-inc/authkit-remix (npm) or WorkOS Authkit-Remix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@workos-inc/authkit-remix (npm): upgrade to 0.4.1 or later
```
npm install @workos-inc/authkit-remix@0.4.1
```

Technical details

This is an information disclosure vulnerability (CWE-532) in the @workos-inc/authkit-remix npm package. The vulnerable component logs refresh tokens to console output when an optional, disabled-by-default debug flag is enabled. No authentication is required to trigger the disclosure—a developer simply needs to enable the debug flag in code. While the debug flag is off by default (limiting accidental exposure), it reduces the barrier to exposing sensitive tokens in environments where debug logs are not properly secured. The vulnerability is patched in version 0.4.1 and later.

Affected products

WorkOS authkit-remix before 0.4.1

Identifiers

CVE-2024-51753
GHSA-v2qh-f584-6hj8

Timeline

2024-11-05: disclosed
2024-11-05: patched: Fixed in v0.4.1

References

https://github.com/workos/authkit-remix/security/advisories/GHSA-v2qh-f584-6hj8

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.