GitHub Advisoryadvisory · npm

GHSA-v3gr-w9gf-23cx The AuthKit Remix Library renders sensitive auth data in HTML

HIGH Published 2025-08-08 Modified 2025-09-25 Official page ↗
Aliases
CVE-2025-55009
Ecosystem
npm
Packages
@workos-inc/authkit-remix
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Weaknesses
CWE-200
Reviewed
2025-08-08

Affected packages

• npm @workos-inc/authkit-remix: < 0.15.0 → fixed in 0.15.0

Description

Summary Before `0.15.0`, `@workos-inc/authkit-remix` returned sensitive authentication artifacts from the `authkitLoader`, specifically `sealedSession` and `accessToken`. Because these values were returned from the loader, they were embedded into the server-rendered HTML and became readable by any script with access to the page’s DOM (e.g., in the presence of XSS or a malicious browser extension). • Impact: Exposure of these secrets can lead to session hijacking and unauthorized API access. • Fix: Version `0.15.0` changes the default behavior so the loader no longer returns `sealedSession`/`accessToken`. A secure server-side mechanism is provided to fetch an access token when needed. Patches Patched in v0.15.0.

Related

Alias · CVE (1)

  • CVE-2025-55009 The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References