The AuthKit React Router Library rendered sensitive auth data in HTML

Description

In versions before 0.7.0, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically sealedSession and accessToken by returning them from the authkitLoader. This caused them to be rendered into the browser HTML.

Recommendation

Update the @workos-inc/authkit-react-router package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.7.0
• Patched version(s): 0.7.0

References

• GHSA-vqvc-9q8x-vmq6
• CVE-2025-55008
• CWE-200
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• The AuthKit Remix Library renders sensitive auth data in HTML - CVE-2025-55009
• React Router has Path Traversal in File Session Storage - CVE-2025-61686
• React Router has Path Traversal in File Session Storage (GHSA-9583-h5hc-x8cw) - CVE-2025-61686
• React Router has XSS Vulnerability - CVE-2025-59057

Tags:

npm

@workos-inc/authkit-react-router