GitHub Advisoryadvisory · npm

GHSA-vqvc-9q8x-vmq6 The AuthKit React Router Library rendered sensitive auth data in HTML

HIGH Published 2025-08-08 Modified 2025-08-11 Official page ↗
Aliases
CVE-2025-55008
Ecosystem
npm
Packages
@workos-inc/authkit-react-router
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Weaknesses
CWE-200
Reviewed
2025-08-08

Affected packages

• npm @workos-inc/authkit-react-router: < 0.7.0 → fixed in 0.7.0

Description

In versions before `0.7.0`, `@workos-inc/authkit-react-router` exposed sensitive authentication artifacts — specifically `sealedSession` and `accessToken` by returning them from the `authkitLoader`. This caused them to be rendered into the browser HTML. Impact This information disclosure could lead to session hijacking in environments where cross-site scripting (XSS), malicious browser extensions, or local inspection is possible. Patches Patched in https://github.com/workos/authkit-react-router/releases/tag/v0.7.0 In patched versions: • `sealedSession` and `accessToken` are no longer returned by default from the `authkitLoader`. • A secure server-side mechanism is provided to fetch an access token as needed.

Related

Alias · CVE (1)

  • CVE-2025-55008 The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References