@workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled

Description

Refresh tokens are logged to the console when the disabled by default debug flag, is enabled.

Recommendation

Update the @workos-inc/authkit-nextjs package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.13.2
• Patched version(s): 0.13.2

References

• GHSA-5wmg-9cvh-qw25
• CVE-2024-51752
• CWE-532
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A9

Related Issues

• @workos-inc/authkit-remix refresh tokens are logged when the debug flag is enabled - CVE-2024-51753
• @workos-inc/authkit-nextjs session replay vulnerability - CVE-2024-29901
• Astro's server source code is exposed to the public if sourcemaps are enabled - CVE-2024-56159
• authkit-nextjs may let session cookies be cached in CDNs - CVE-2025-64762

Tags:

npm

@workos-inc/authkit-nextjs