Description
In versions before 0.7.0, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically sealedSession and accessToken by returning them from the authkitLoader. This caused them to be rendered into the browser HTML.
Recommendation
Update the @workos-inc/authkit-react-router package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.7.0
- Patched version(s): 0.7.0
References
Could your website be exposed too?
SmartScanner can check your website for The AuthKit React Router Library rendered sensitive auth data in HTML and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @clerk/backend Performs Insufficient Verification of Data Authenticity - @clerk/react-router - CVE-2025-53548
- React Router has Path Traversal in File Session Storage - CVE-2025-61686
- React Router has XSS Vulnerability - CVE-2025-59057
- Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers - CVE-2025-31137
You might also like:
See something that needs correcting? Let us knowUpdated August 11, 2025