CVE-2025-55008: @workos-inc/authkit-react-router Exposes Sensitive Authentication Data in HTML
Summary
CVE-2025-55008: The AuthKit React Router Library rendered sensitive auth data in HTML. Affects @workos-inc/authkit-react-router versions < 0.7.0. Fixed in 0.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @workos-inc/authkit-react-router package is a library designed for integrating authentication features into React applications using the WorkOS platform. It provides developers with tools to manage user sessions and authentication flows seamlessly. However, prior to version 0.7.0, the library had a significant vulnerability that exposed sensitive authentication artifacts directly in the rendered HTML, potentially compromising user security.
Vulnerability Detail
In versions before 0.7.0, the @workos-inc/authkit-react-router package inadvertently exposed sensitive authentication artifacts, specifically 'sealedSession' and 'accessToken', by returning them from the 'authkitLoader'. This flaw allowed these sensitive tokens to be rendered in the browser's HTML, leading to potential information disclosure. If an attacker can exploit this vulnerability, they could hijack user sessions in environments susceptible to cross-site scripting (XSS), malicious browser extensions, or local inspection.
How To Fix
Minimum fixed version
0.7.0
This is the first release that contains the fix.
npm install @workos-inc/authkit-react-router@0.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can avoid using the 'authkitLoader' until you have updated to the patched version. Additionally, ensure that your application has proper security measures in place to mitigate the risk of XSS attacks.
Conclusion
The @workos-inc/authkit-react-router package had a significant vulnerability that exposed sensitive authentication data in HTML prior to version 0.7.0. It is crucial for developers using this package to update to the patched version to protect their applications from potential session hijacking attacks.
See every vulnerability recorded for @workos-inc/authkit-react-router →
FAQ
CVE-2025-55008 is a vulnerability in the @workos-inc/authkit-react-router package that exposes sensitive authentication data in the HTML rendered by the application.
This vulnerability can lead to session hijacking, allowing attackers to gain unauthorized access to user accounts if they can exploit the exposed tokens.
If you are using a version prior to 0.7.0, you should update the package to the latest version immediately to mitigate the risk.
While there are no specific known exploits reported, the nature of the vulnerability makes it susceptible to attacks that leverage XSS or similar techniques.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
