CVE-2025-55009: The AuthKit Remix Library renders sensitive auth data in HTML
(updated )
Before 0.15.0, @workos-inc/authkit-remix returned sensitive authentication artifacts from the authkitLoader, specifically sealedSession and accessToken. Because these values were returned from the loader, they were embedded into the server-rendered HTML and became readable by any script with access to the page’s DOM (e.g., in the presence of XSS or a malicious browser extension).
- Impact: Exposure of these secrets can lead to session hijacking and unauthorized API access.
- Fix: Version
0.15.0changes the default behavior so the loader no longer returnssealedSession/accessToken. A secure server-side mechanism is provided to fetch an access token when needed.
References
- github.com/advisories/GHSA-v3gr-w9gf-23cx
- github.com/workos/authkit-remix
- github.com/workos/authkit-remix/commit/20102afc74bf3dd5150a975a098067fb406b90b6
- github.com/workos/authkit-remix/releases/tag/v0.15.0
- github.com/workos/authkit-remix/security/advisories/GHSA-v3gr-w9gf-23cx
- nvd.nist.gov/vuln/detail/CVE-2025-55009
- osv.dev/vulnerability/CVE-2025-55009
- osv.dev/vulnerability/GHSA-v3gr-w9gf-23cx
Code Behaviors & Features
Detect and mitigate CVE-2025-55009 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →