Executive brief
AuthKit Remix is a library used to integrate authentication and user management into Remix web applications. Versions before 0.15.0 exposed sensitive authentication tokens (session data and API access tokens) by embedding them directly in the HTML pages served to browsers, making them readable to malicious scripts or browser extensions. This could allow attackers to hijack user sessions or make unauthorized API calls on behalf of users.
Technical details
The vulnerability is a sensitive data exposure issue (CWE-200) in the @workos-inc/authkit-remix library. The authkitLoader function returned sensitive authentication artifacts—sealedSession and accessToken—which were then embedded into server-rendered HTML and accessible to any script with DOM access. An attacker with an XSS vulnerability, malicious browser extension, or local access could read these tokens from the page. The vulnerability requires low privileges (an authenticated user) and high attack complexity. Versions 0.15.0 and later fix this by removing these values from the default loader return and providing a secure server-side mechanism for token retrieval.
Affected products
- WorkOS AuthKit Remix before 0.15.0
Timeline
- 2025-08-08: disclosed
- 2025-08-08: patched: Fixed in v0.15.0