CVE-2025-55008

The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router. In versions 0.6.1 and below, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically sealedSession and accessToken by returning them from the authkitLoader. This caused them to be rendered into the browser HTML. This issue is fixed in version 0.7.0.

• CWE-200

• https://github.com/workos/authkit-react-router/commit/607caac658784962bab76e227f9c5820d0b9a9e5
• https://github.com/workos/authkit-react-router/releases/tag/v0.7.0
• https://github.com/workos/authkit-react-router/security/advisories/GHSA-vqvc-9q8x-vmq6

Published

Aug 9, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-55001OpenBao exists to provide a software solution to manage, sto…6.5
• CVE-2025-55003OpenBao exists to provide a software solution to manage, sto…5.7
• CVE-2025-55004ImageMagick is free and open-source software used for editin…4.3
• CVE-2025-55005ImageMagick is free and open-source software used for editin…5.5
• CVE-2025-55006Frappe Learning is a learning system that helps users struct…8.8
• CVE-2025-55007Knowage is an open source analytics and business intelligenc…5.3
• CVE-2025-55009The AuthKit library for Remix provides convenient helpers fo…7.1
• CVE-2025-5501A vulnerability classified as problematic was found in Open5…6.9
• CVE-2025-55010Kanboard is project management software that focuses on the …7.2
• CVE-2025-55011Kanboard is project management software that focuses on the …5.3
• CVE-2025-55012Zed is a multiplayer code editor. Prior to version 0.197.3, …8.5
• CVE-2025-55013The Assemblyline 4 Service Client interfaces with the API to…4.2