CVE-2025-55008

Published: Aug 9, 2025Modified: Jun 17, 2026Deferred

7.1

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Exploitability: 1.6 / Impact: 5.5

Source: security-advisories@github.com (Secondary)

Description

The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router. In versions 0.6.1 and below, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically sealedSession and accessToken by returning them from the authkitLoader. This caused them to be rendered into the browser HTML. This issue is fixed in version 0.7.0.

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (3)

https://github.com/workos/authkit-react-router/commit/607caac658784962bab76e227f9c5820d0b9a9e5

Source: security-advisories@github.com

https://github.com/workos/authkit-react-router/releases/tag/v0.7.0

Source: security-advisories@github.com

https://github.com/workos/authkit-react-router/security/advisories/GHSA-vqvc-9q8x-vmq6

Source: security-advisories@github.com

Timeline

No history available yet.