CVE-2025-55009
CVE-2025-55009 · AuthKit: Sensitive auth data rendered in HTML
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In versions 0.14.1 and below, @workos-inc/authkit-remix exposed sensitive authentication artifacts — specifically sealedSession and accessToken — by returning them from the authkitLoader. This caused them to be rendered into the browser HTML.
CVSS 7.1 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
authkit-remix
- Versions
- < 0.15.0: Affected
No fix published
@workos-inc/authkit-remix npm
- Affected ranges
- SEMVER: < 0.15.0
Update to 0.15.0