Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for authkit-react-router by workos

    CVE-2025-55008 (GCVE-0-2025-55008)

    Vulnerability from nvd – Published: 2025-08-09 02:02 – Updated: 2025-08-11 14:33
    VLAI
    Title
    AuthKit React Router: Sensitive auth data rendered in HTML
    Summary
    The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router. In versions 0.6.1 and below, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically sealedSession and accessToken by returning them from the authkitLoader. This caused them to be rendered into the browser HTML. This issue is fixed in version 0.7.0.
    Severity
    7.1 (High)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
    Assigner
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-55008",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-11T14:32:24.190307Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-11T14:33:33.678Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "authkit-react-router",
          "vendor": "workos",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.7.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS \u0026 AuthKit with React Router. In versions 0.6.1 and below, @workos-inc/authkit-react-router exposed sensitive authentication artifacts \u2014 specifically sealedSession and accessToken by returning them from the authkitLoader. This caused them to be rendered into the browser HTML. This issue is fixed in version 0.7.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-09T02:02:14.950Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/workos/authkit-react-router/security/advisories/GHSA-vqvc-9q8x-vmq6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/workos/authkit-react-router/security/advisories/GHSA-vqvc-9q8x-vmq6"
        },
        {
          "name": "https://github.com/workos/authkit-react-router/commit/607caac658784962bab76e227f9c5820d0b9a9e5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/workos/authkit-react-router/commit/607caac658784962bab76e227f9c5820d0b9a9e5"
        },
        {
          "name": "https://github.com/workos/authkit-react-router/releases/tag/v0.7.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/workos/authkit-react-router/releases/tag/v0.7.0"
        }
      ],
      "source": {
        "advisory": "GHSA-vqvc-9q8x-vmq6",
        "discovery": "UNKNOWN"
      },
      "title": "AuthKit React Router: Sensitive auth data rendered in HTML"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-55008",
    "datePublished": "2025-08-09T02:02:14.950Z",
    "dateReserved": "2025-08-04T17:34:24.422Z",
    "dateUpdated": "2025-08-11T14:33:33.678Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-55008 (GCVE-0-2025-55008)

    Vulnerability from cvelistv5 – Published: 2025-08-09 02:02 – Updated: 2025-08-11 14:33
    VLAI
    Title
    AuthKit React Router: Sensitive auth data rendered in HTML
    Summary
    The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router. In versions 0.6.1 and below, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically sealedSession and accessToken by returning them from the authkitLoader. This caused them to be rendered into the browser HTML. This issue is fixed in version 0.7.0.
    Severity
    7.1 (High)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
    Assigner
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-55008",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-11T14:32:24.190307Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-11T14:33:33.678Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "authkit-react-router",
          "vendor": "workos",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.7.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS \u0026 AuthKit with React Router. In versions 0.6.1 and below, @workos-inc/authkit-react-router exposed sensitive authentication artifacts \u2014 specifically sealedSession and accessToken by returning them from the authkitLoader. This caused them to be rendered into the browser HTML. This issue is fixed in version 0.7.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-09T02:02:14.950Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/workos/authkit-react-router/security/advisories/GHSA-vqvc-9q8x-vmq6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/workos/authkit-react-router/security/advisories/GHSA-vqvc-9q8x-vmq6"
        },
        {
          "name": "https://github.com/workos/authkit-react-router/commit/607caac658784962bab76e227f9c5820d0b9a9e5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/workos/authkit-react-router/commit/607caac658784962bab76e227f9c5820d0b9a9e5"
        },
        {
          "name": "https://github.com/workos/authkit-react-router/releases/tag/v0.7.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/workos/authkit-react-router/releases/tag/v0.7.0"
        }
      ],
      "source": {
        "advisory": "GHSA-vqvc-9q8x-vmq6",
        "discovery": "UNKNOWN"
      },
      "title": "AuthKit React Router: Sensitive auth data rendered in HTML"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-55008",
    "datePublished": "2025-08-09T02:02:14.950Z",
    "dateReserved": "2025-08-04T17:34:24.422Z",
    "dateUpdated": "2025-08-11T14:33:33.678Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}