@workos-inc/authkit-remix refresh tokens are logged when the debug flag is enabled

Description

Refresh tokens are logged to the console when the disabled by default debug flag, is enabled.

Recommendation

Update the @workos-inc/authkit-remix package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.4.1
• Patched version(s): 0.4.1

References

• GHSA-v2qh-f584-6hj8
• CVE-2024-51753
• CWE-532
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A9

Related Issues

• @workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled - CVE-2024-51752
• @workos-inc/authkit-nextjs session replay vulnerability - CVE-2024-29901
• Astro's server source code is exposed to the public if sourcemaps are enabled - CVE-2024-56159
• The AuthKit Remix Library renders sensitive auth data in HTML - CVE-2025-55009

Tags:

npm

@workos-inc/authkit-remix