CVE-2025-55009: AuthKit for Remix Information Disclosure

CVE-2025-55009 Overview

CVE-2025-55009 affects the @workos-inc/authkit-remix library, which provides authentication and session management helpers for Remix applications using WorkOS and AuthKit. In versions 0.14.1 and below, the authkitLoader function returned sensitive authentication artifacts — specifically sealedSession and accessToken — directly from the loader. Remix serializes loader return values into the browser HTML, causing these secrets to be rendered client-side where any script or browser extension can read them. The flaw is classified as an information disclosure issue [CWE-200] and impacts both authenticated and unauthenticated data interfaces exposed by the library.

Critical Impact
Sensitive session tokens were embedded in server-rendered HTML, allowing attackers with client-side access to harvest access tokens and sealed sessions for account takeover.

Affected Products

@workos-inc/authkit-remix versions 0.14.1 and below
Remix applications integrating WorkOS AuthKit for session management
Applications relying on the authkitLoader to provide authentication state to routes

Discovery Timeline

2025-08-09 - CVE-2025-55009 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55009

Vulnerability Analysis

The vulnerability stems from how authkitLoader shaped its return value. Remix loaders execute on the server, but their return data is serialized and embedded in the HTML payload sent to the browser. This allows client-side code to hydrate using the same data. When authkitLoader returned the AuthorizedData interface, it included both accessToken and sealedSession fields. Both values are server-side secrets: accessToken is a bearer credential for API calls, and sealedSession is an encrypted session blob meant to remain in HTTP-only cookies.

By rendering these values into the DOM, the library exposed them to any JavaScript executing in the page context. Cross-site scripting payloads, malicious browser extensions, and third-party scripts loaded by the application could all read the tokens directly from the hydration payload.

Root Cause

The root cause is an information exposure flaw [CWE-200] in the public type contract of authkitLoader. The AuthorizedData and UnauthorizedData interfaces declared accessToken and sealedSession as fields returned to route components. Because Remix automatically transmits loader returns to the browser, declaring these properties on the loader output guaranteed their inclusion in the HTML document.

Attack Vector

An attacker with the ability to execute JavaScript in the application's origin — through stored XSS, a compromised dependency, or a malicious browser extension — could extract the embedded accessToken and sealedSession values from the hydrated page state. The stolen accessToken enables direct API calls under the victim's identity, while the sealedSession permits session replay.

typescript

 export interface AuthorizedData {
   user: User;
   sessionId: string;
-  accessToken: string;
   organizationId: string | null;
   role: string | null;
   permissions: string[];
   entitlements: string[];
   impersonator: Impersonator | null;
-  sealedSession: string;
 }
 
 export interface UnauthorizedData {
   user: null;
   sessionId: null;
-  accessToken: null;
   organizationId: null;
   role: null;
   permissions: null;
   entitlements: null;
   impersonator: null;
-  sealedSession: null;
 }

Source: GitHub Commit 20102af

The patch removes accessToken and sealedSession from the loader return shape entirely. A new getAccessToken callback is injected into the loader arguments so server-side code can still retrieve the token without serializing it into the HTML response.

typescript

 type AuthLoader<Data> = (
-  args: LoaderFunctionArgs & { auth: AuthorizedData | UnauthorizedData },
+  args: LoaderFunctionArgs & { auth: AuthorizedData | UnauthorizedData; getAccessToken: () => string | null },
 ) => LoaderReturnValue<Data>;
 
-type AuthorizedAuthLoader<Data> = (args: LoaderFunctionArgs & { auth: AuthorizedData }) => LoaderReturnValue<Data>;
+type AuthorizedAuthLoader<Data> = (args: LoaderFunctionArgs & { auth: AuthorizedData; getAccessToken: () => string }) => LoaderReturnValue<Data>;

Source: GitHub Commit 20102af

Detection Methods for CVE-2025-55009

Indicators of Compromise

Presence of accessToken or sealedSession string values in rendered HTML, typically inside the Remix hydration script tag (<script>window.__remixContext</script>).
Use of @workos-inc/authkit-remix at version 0.14.1 or earlier in package.json or package-lock.json.
Unexpected API calls to WorkOS endpoints originating from IP addresses or user agents that differ from legitimate session activity.

Detection Strategies

Inspect rendered HTML responses for the literal field names accessToken and sealedSession within the Remix context payload.
Audit dependency manifests across Remix repositories for vulnerable versions of @workos-inc/authkit-remix.
Correlate WorkOS audit logs against application access logs to identify session reuse from anomalous client fingerprints.

Monitoring Recommendations

Enable WorkOS session and token usage logging, alerting on token reuse from new IP ranges or user agents.
Monitor browser content security policy (CSP) violation reports to surface unexpected script execution that could exfiltrate hydration data.
Track outbound dependency changes in CI pipelines to confirm patched versions remain pinned.

How to Mitigate CVE-2025-55009

Immediate Actions Required

Upgrade @workos-inc/authkit-remix to version 0.15.0 or later, which removes the exposed fields from loader output.
Refactor any application code that read accessToken or sealedSession from loader data to use the new getAccessToken callback on the server.
Rotate or invalidate active WorkOS sessions issued while running vulnerable versions to neutralize any tokens that may have been exfiltrated.

Patch Information

The fix is published in GitHub Release v0.15.0 and tracked under GHSA-v3gr-w9gf-23cx. The implementation in commit 20102af removes accessToken and sealedSession from the AuthorizedData and UnauthorizedData interfaces and introduces a getAccessToken helper injected into loader arguments.

Workarounds

If immediate upgrade is not possible, wrap authkitLoader so that returned data is filtered to remove accessToken and sealedSession before reaching the route component.
Restrict third-party script inclusion and tighten CSP script-src directives to reduce the risk of token exfiltration from the hydration payload.

bash

# Upgrade to the patched release
npm install @workos-inc/authkit-remix@^0.15.0

# Verify installed version
npm ls @workos-inc/authkit-remix