The AuthKit React Router Library rendered sensitive auth data in HTML
In versions before 0.7.0, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically sealedSession and accessToken by returning them from the authkitLoader. This caused them to be rendered into the browser HTML.
Impact
This information disclosure could lead to session hijacking in environments where cross-site scripting (XSS), malicious browser extensions, or local inspection is possible.
Patches
Patched in https://github.com/workos/authkit-react-router/releases/tag/v0.7.0
In patched versions:
sealedSessionandaccessTokenare no longer returned by default from theauthkitLoader.- A secure server-side mechanism is provided to fetch an access token as needed.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @workos-inc/authkit-react-router | < 0.7.0 | 0.7.0 |
References
- https://github.com/workos/authkit-react-router/security/advisories/GHSA-vqvc-9q8x-vmq6
- https://nvd.nist.gov/vuln/detail/CVE-2025-55008
- https://github.com/workos/authkit-react-router/commit/607caac658784962bab76e227f9c5820d0b9a9e5
- https://github.com/workos/authkit-react-router
- https://github.com/workos/authkit-react-router/releases/tag/v0.7.0
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L- Weakness (CWE)
CWE-200- Platform
- npm
- Package
@workos-inc/authkit-react-router- Disclosed
- 08.08.2025
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-vqvc-9q8x-vmq6 - CC BY 4.0
Vulnerability history: @workos-inc/authkit-react-router
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.