The AuthKit React Router Library rendered sensitive auth data in HTML
Date: 2025-08
Affected: npm/@workos-inc/authkit-react-router
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2025-55008
CWE: CWE-200
CVSS: 7.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L)

In versions before `0.7.0`, `@workos-inc/authkit-react-router` exposed sensitive authentication artifacts — specifically `sealedSession` and `accessToken` by returning them from the `authkitLoader`. This caused them to be rendered into the browser HTML. ### Impact This information disclosure could lead to session hijacking in environments where cross-site scripting (XSS), malicious browser extensions, or local inspection is possible. ### Patches Patched in [https://github.com/workos/authkit-react-router/releases/tag/v0.7.0](https://github.com/workos/authkit-react-router/releases/tag/v0.7.0) In patched versions: - `sealedSession` and `accessToken` are no longer returned by default from the `authkitLoader`. - A secure server-side mechanism is provided to fetch an access token as needed.


Mitigations:

Architectural layers (MAESTRO):