CVE-2025-55008

HIGH

7.1

Beschreibung

The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router. In versions 0.6.1 and below, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically sealedSession and accessToken by returning them from the authkitLoader. This caused them to be rendered into the browser HTML. This issue is fixed in version 0.7.0.

CVE Details

CVSS v3.1 Bewertung7.1

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

AngriffsvektorNETWORK

KomplexitatHIGH

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht8/9/2025

Zuletzt geandert8/11/2025

Quellenvd

Honeypot-Sichtungen0

Schwachen (CWE)

CWE-200

Referenzen

https://github.com/workos/authkit-react-router/commit/607caac658784962bab76e227f9c5820d0b9a9e5(security-advisories@github.com)

https://github.com/workos/authkit-react-router/releases/tag/v0.7.0(security-advisories@github.com)

https://github.com/workos/authkit-react-router/security/advisories/GHSA-vqvc-9q8x-vmq6(security-advisories@github.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.