GHSA-5wmg-9cvh-qw25

Source

https://github.com/advisories/GHSA-5wmg-9cvh-qw25

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-5wmg-9cvh-qw25/GHSA-5wmg-9cvh-qw25.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5wmg-9cvh-qw25

Aliases

CVE-2024-51752

Published

2024-11-05T17:34:23Z

Modified

2024-11-05T21:37:24Z

Severity

0.4 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

@workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled

Details

Impact

Refresh tokens are logged to the console when the disabled by default debug flag, is enabled.

Patches

Patched in https://github.com/workos/authkit-nextjs/releases/tag/v0.13.2

Database specific

{
    "cwe_ids": [
        "CWE-532"
    ],
    "nvd_published_at": "2024-11-05T20:15:15Z",
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-05T17:34:23Z"
}

References

Affected packages

npm / @workos-inc/authkit-nextjs

Package

Name: @workos-inc/authkit-nextjs; View open source insights on deps.dev
Purl: pkg:npm/%40workos-inc/authkit-nextjs

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.13.2