The AuthKit React Router Library rendered sensitive auth data in HTML

Description

In versions before 0.7.0, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically sealedSession and accessToken by returning them from the authkitLoader. This caused them to be rendered into the browser HTML.

Recommendation

Update the @workos-inc/authkit-react-router package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.7.0
• Patched version(s): 0.7.0

References

• GHSA-vqvc-9q8x-vmq6
• CVE-2025-55008
• CWE-200
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• CodeceptJS's incomprehensive sanitation can lead to Command Injection - CVE-2025-57285
• Payload does not invalidate JWTs after log out (GHSA-5v66-m237-hwf7) 2 - CVE-2025-4643
• Vite allows server.fs.deny to be bypassed with .svg or relative paths - CVE-2025-31486
• tarteaucitron.js allows prototype pollution via custom text injection - CVE-2025-31475

Tags:

npm

@workos-inc/authkit-react-router