GHSA-vqvc-9q8x-vmq6

Source

https://github.com/advisories/GHSA-vqvc-9q8x-vmq6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-vqvc-9q8x-vmq6/GHSA-vqvc-9q8x-vmq6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vqvc-9q8x-vmq6

Aliases

CVE-2025-55008

Published

2025-08-08T17:04:11Z

Modified

2025-08-11T13:57:10Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L CVSS Calculator

Summary

The AuthKit React Router Library rendered sensitive auth data in HTML

Details

In versions before 0.7.0, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically sealedSession and accessToken by returning them from the authkitLoader. This caused them to be rendered into the browser HTML.

Impact

This information disclosure could lead to session hijacking in environments where cross-site scripting (XSS), malicious browser extensions, or local inspection is possible.

Patches

Patched in https://github.com/workos/authkit-react-router/releases/tag/v0.7.0

In patched versions:

sealedSession and accessToken are no longer returned by default from the authkitLoader.
A secure server-side mechanism is provided to fetch an access token as needed.

Database specific

{
    "cwe_ids": [
        "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-08T17:04:11Z",
    "nvd_published_at": "2025-08-09T03:15:47Z",
    "severity": "HIGH"
}

References

Affected packages

npm / @workos-inc/authkit-react-router

Package

Name: @workos-inc/authkit-react-router; View open source insights on deps.dev
Purl: pkg:npm/%40workos-inc/authkit-react-router

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.7.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-vqvc-9q8x-vmq6/GHSA-vqvc-9q8x-vmq6.json"