@workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled

Description

Refresh tokens are logged to the console when the disabled by default debug flag, is enabled.

Recommendation

Update the @workos-inc/authkit-nextjs package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.13.2
• Patched version(s): 0.13.2

References

• GHSA-5wmg-9cvh-qw25
• CVE-2024-51752
• CWE-532
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A9

Related Issues

• Astro development server error page is vulnerable to reflected Cross-site Scripting - CVE-2025-64745
• @plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user - CVE-2025-61668
• Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS) - CVE-2025-27109
• Systeminformation has command injection vulnerability in getWindowsIEEE8021x (SSID) - CVE-2024-56334

Tags:

npm

@workos-inc/authkit-nextjs