PT-2025-32422 · Workos · Authkit

Highmarji-Workos · Published 2025-08-08 · Updated 2025-08-10 · CVE-2025-55009

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions @workos-inc/authkit-remix versions 0.14.1 and below

Description The AuthKit library for Remix exposed sensitive authentication artifacts – specifically sealedSession and accessToken – by returning them from the authkitLoader, causing them to be rendered into the browser HTML. This could lead to session hijacking in environments where cross-site scripting (XSS), malicious browser extensions, or local inspection is possible.

Recommendations Update to version 0.15.0 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-55009

GHSA-V3GR-W9GF-23CX

Affected Products

Authkit

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55009.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-55009 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v3gr-w9gf-23cx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55009 · Security Note
• https://github.com/workos/authkit-remix/security/advisories/GHSA-v3gr-w9gf-23cx · Note
• https://github.com/workos/authkit-remix · Note
• https://github.com/workos/authkit-remix/releases/tag/v0.15.0 · Note
• https://github.com/workos/authkit-remix/commit/20102afc74bf3dd5150a975a098067fb406b90b6 · Note
• https://twitter.com/CVEnew/status/1954014368854946132 · Twitter Post
• https://twitter.com/offseq/status/1954399954320924911 · Twitter Post
• https://t.me/CVEtracker/29571 · Telegram Post