CVE-2025-55008
The AuthKit React Router Library rendered sensitive auth data in HTML
Impact
In versions before `0.7.0`, `@workos-inc/authkit-react-router` exposed sensitive authentication artifacts — specifically `sealedSession` and `accessToken` by returning them from the `authkitLoader`. This caused them to be rendered into the browser HTML. ### Impact This information disclosure could lead to session hijacking in environments where cross-site scripting (XSS), malicious browser extensions, or local inspection is possible. ### Patches Patched in [https://github.com/workos/authkit-react-router/releases/tag/v0.7.0](https://github.com/workos/authkit-react-router/releases/tag/v0.7.0) In patched versions: - `sealedSession` and `accessToken` are no longer returned by default from the `authkitLoader`. - A secure server-side mechanism is provided to fetch an access token as needed.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @workos-inc/authkit-react-router | < 0.7.0 | 0.7.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/workos/authkit-react-router/commit/607caac658784962bab76e227f9c5820d0b9a9e5
- https://github.com/workos/authkit-react-router/releases/tag/v0.7.0
- https://github.com/workos/authkit-react-router/security/advisories/GHSA-vqvc-9q8x-vmq6
- https://github.com/advisories/GHSA-vqvc-9q8x-vmq6
- https://nvd.nist.gov/vuln/detail/CVE-2025-55008