CVE-2024-51752
📋 TL;DR
The AuthKit library for Next.js logs refresh tokens to the console when the debug flag is enabled, potentially exposing sensitive authentication credentials. This affects users of AuthKit for Next.js versions before 0.13.2 who have enabled debug logging. Attackers with access to console logs could steal refresh tokens and potentially hijack user sessions.
💻 Affected Systems
- AuthKit library for Next.js
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain access to console logs containing refresh tokens, allowing them to impersonate users, access sensitive data, and maintain persistent unauthorized access to applications.
Likely Case
Refresh tokens exposed in development or staging environments could be compromised if logs are not properly secured, leading to unauthorized access to those environments.
If Mitigated
With debug logging disabled (default configuration), no exposure occurs. Proper log security and access controls prevent token leakage even if debug is enabled.
🎯 Exploit Status
Exploitation requires access to console logs where debug output is written. No special tools or techniques needed beyond log access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.13.2
Vendor Advisory: https://github.com/workos/authkit-nextjs/security/advisories/GHSA-5wmg-9cvh-qw25
Restart Required: Yes
Instructions:
1. Update package.json to use authkit-nextjs version 0.13.2 or later. 2. Run 'npm update @workos-inc/authkit-nextjs' or 'yarn upgrade @workos-inc/authkit-nextjs'. 3. Restart your Next.js application.
🔧 Temporary Workarounds
Disable debug logging
allEnsure the debug flag is not enabled in AuthKit configuration
Check your AuthKit configuration and remove or set debug: false
🧯 If You Can't Patch
- Ensure debug logging is disabled in all environments
- Implement strict access controls and monitoring for application logs
🔍 How to Verify
Check if Vulnerable:
Check package.json for @workos-inc/authkit-nextjs version. If version is below 0.13.2 and debug logging is enabled, the system is vulnerable.Check Version:
npm list @workos-inc/authkit-nextjs or check package.jsonVerify Fix Applied:
Verify package.json shows version 0.13.2 or later and check that refresh tokens are no longer logged when debug is enabled.📡 Detection & Monitoring
Log Indicators:
- Refresh tokens appearing in console logs or application logs
- Debug log entries containing authentication tokens
Network Indicators:
- None - this is a local logging issue
SIEM Query:
Search for patterns matching refresh tokens in application logs: /refresh_token=[A-Za-z0-9._-]+/ or similar token patterns