Executive brief
WorkOS authkit-remix is an authentication library used by developers to add login/logout functionality to Remix web applications. When a developer enables the debug flag in development/testing, refresh tokens (sensitive credentials used to obtain new access tokens) are exposed in console logs. An attacker with access to logs or console output could steal these tokens and impersonate users or access protected resources.
Technical details
This is an information disclosure vulnerability (CWE-532) in the @workos-inc/authkit-remix npm package. The vulnerable component logs refresh tokens to console output when an optional, disabled-by-default debug flag is enabled. No authentication is required to trigger the disclosure—a developer simply needs to enable the debug flag in code. While the debug flag is off by default (limiting accidental exposure), it reduces the barrier to exposing sensitive tokens in environments where debug logs are not properly secured. The vulnerability is patched in version 0.4.1 and later.
Affected products
- WorkOS authkit-remix before 0.4.1
Timeline
- 2024-11-05: disclosed
- 2024-11-05: patched: Fixed in v0.4.1