GitStock

workos/authkit-react-router · Security

The AuthKit React Router Library rendered sensitive auth data in HTML

GHSA ID
GHSA-vqvc-9q8x-vmq6
CVE ID
CVE-2025-55008
Severity
high
Published
Updated
CVSS
7.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
CVSS v3
7.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Description

In versions before 0.7.0, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically sealedSession and accessToken by returning them from the authkitLoader. This caused them to be rendered into the browser HTML.

Impact

This information disclosure could lead to session hijacking in environments where cross-site scripting (XSS), malicious browser extensions, or local inspection is possible.

Patches

Patched in https://github.com/workos/authkit-react-router/releases/tag/v0.7.0

In patched versions:

  • sealedSession and accessToken are no longer returned by default from the authkitLoader.
  • A secure server-side mechanism is provided to fetch an access token as needed.

CWEs

  • CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor

References

Open GitHub