CVE-2025-55009: @workos-inc/authkit-remix Exposes Sensitive Authentication Data in HTML
Summary
CVE-2025-55009: The AuthKit Remix Library renders sensitive auth data in HTML. Affects @workos-inc/authkit-remix versions < 0.15.0. Fixed in 0.15.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @workos-inc/authkit-remix package is a library designed to facilitate authentication processes in Remix applications. It provides developers with tools to manage user sessions and access tokens securely. However, prior to version 0.15.0, the library had a significant vulnerability that allowed sensitive authentication artifacts to be rendered in the browser's HTML, potentially compromising user security.
Vulnerability Detail
In versions before 0.15.0, the @workos-inc/authkit-remix package exposed sensitive authentication artifacts, specifically sealedSession and accessToken, by returning them from the authkitLoader. This exposure could lead to session hijacking in environments susceptible to cross-site scripting (XSS), malicious browser extensions, or local inspection. The vulnerability is classified under CWE-200, indicating information exposure.
How To Fix
Minimum fixed version
0.15.0
This is the first release that contains the fix.
npm install @workos-inc/authkit-remix@0.15.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually modify the authkitLoader to prevent the return of sealedSession and accessToken until the package is updated. This can be done by ensuring that these artifacts are not included in the response sent to the client.
Conclusion
The vulnerability CVE-2025-55009 in the @workos-inc/authkit-remix package poses a significant risk by exposing sensitive authentication data in HTML. It is crucial for developers to update to version 0.15.0 or later to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for @workos-inc/authkit-remix →
FAQ
CVE-2025-55009 is a vulnerability in the @workos-inc/authkit-remix package that exposes sensitive authentication data in HTML, potentially leading to session hijacking.
Versions prior to 0.15.0 of the @workos-inc/authkit-remix package are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
If an immediate update is not possible, implement a workaround by modifying the authkitLoader to prevent sensitive data from being returned until the package can be updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for @workos-inc/authkit-remix.
