CVE-2024-51752 - CVE House
Back to Database
Status published Low CVE-2024-51752

Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-nextjs

Vulnerability Description

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In affected versions refresh tokens are logged to the console when the disabled by default `debug` flag, is enabled. This issue has been patched in version 0.13.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-51752

Credits & Attribution

No credits recorded in the NVD database.

References

More from workos

View All →
CVE-2025-64762
authkit-nextjs may let session cookies be cached in CDNs
High 8
CVE-2025-55009
AuthKit: Sensitive auth data rendered in HTML
High 7.1
CVE-2025-55008
AuthKit React Router: Sensitive auth data rendered in HTML
High 7.1
CVE-2024-51753
Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-remix
Low 2.1
CVE-2024-29901
@workos-inc/authkit-nextjs session replay vulnerability
Medium 4.8

Affected Vendor

Affected Software

authkit-nextjs
Vulnerable Versions:
< 0.13.2

Timeline

Official Publish: November 5th, 2024
Last Modified: November 5th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-532

MITRE ATT&CK TTPs

T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1555 Credentials from Password Stores
Credential Access
T1078 Valid Accounts
Persistence
T1562 Impair Defenses
Defense Evasion