CVE-2024-51752
Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-nextjs
The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In affected versions refresh tokens are logged to the console when the disabled by default debug flag, is enabled. This issue has been patched in version 0.13.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-nextjs
The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In affected versions refresh tokens are logged to the console when the disabled by default debug flag, is enabled. This issue has been patched in version 0.13.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-51752- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-532
- Updated
- 2026-11-02
EUVDEUVD-2024-3200
The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In affected versions refresh tokens are logged to the console when the disabled by default debug flag, is enabled. This issue has been patched in version 0.13.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
EUVD-2024-3200- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5wmg-9cvh-qw25
@workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled
Impact
Refresh tokens are logged to the console when the disabled by default debug flag, is enabled.
Patches
Patched in https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2
- Record
GHSA-5wmg-9cvh-qw25- CVSS 4.0
- 0.4 Low
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-532
- Updated
- 2026-11-02
NVD
The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In affected versions refresh tokens are logged to the console when the disabled by default debug flag, is enabled. This issue has been patched in version 0.13.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-51752- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSV
Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-nextjs
The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In affected versions refresh tokens are logged to the console when the disabled by default debug flag, is enabled. This issue has been patched in version 0.13.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-51752- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSVGHSA-5wmg-9cvh-qw25
@workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled
Impact
Refresh tokens are logged to the console when the disabled by default debug flag, is enabled.
Patches
Patched in https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2
- Record
GHSA-5wmg-9cvh-qw25- CVSS 4.0
- 0.4 Low
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-532
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@workos-inc/authkit-nextjsnpm |
before 0.13.2 | 0.13.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-51752 is a low vulnerability (CVSS 2.1) in Workos Authkit-nextjs, published November 5, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 15th percentile. Fixed in @workos-inc/authkit-nextjs 0.13.2.
References
github.com/workos/authkit-nextjs/security/advisories/GHSA-5wmg-9cvh-qw25
nvd.nist.gov/vuln/detail/CVE-2024-51752