CVE-2025-55009

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-55009

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55009.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-55009

Aliases

GHSA-v3gr-w9gf-23cx

Published

2025-08-09T02:02:07.611Z

Modified

2025-12-05T10:20:01.391101Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L CVSS Calculator

Summary

AuthKit: Sensitive auth data rendered in HTML

Details

The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In versions 0.14.1 and below, @workos-inc/authkit-remix exposed sensitive authentication artifacts — specifically sealedSession and accessToken — by returning them from the authkitLoader. This caused them to be rendered into the browser HTML.

Database specific

{
    "cwe_ids": [
        "CWE-200"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55009.json"
}

References

Affected packages

Git / github.com/workos/authkit-remix

Affected ranges

Type: GIT
Repo: https://github.com/workos/authkit-remix
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

233d6c9f69ef716605e2ac49a6ac55b9b2f937d6

Affected versions

v0.*

v0.1.0

v0.10.0

v0.11.0

v0.12.0

v0.13.0

v0.14.0

v0.14.1

v0.2.0

v0.3.0

v0.3.1

v0.4.0

v0.4.1

v0.5.0

v0.6.0

v0.7.0

v0.7.1

v0.8.0

v0.9.0

v0.9.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55009.json"