CVE-2025-55009

Executive Summary

CVE-2025-55009 is an information disclosure vulnerability in the @workos-inc/authkit-remix library, versions 0.14.1 and below. The flaw arises because the authkitLoader function returns sensitive authentication artifacts—specifically sealedSession and accessToken—directly to the client. When used in a Remix application, these values are serialized into the HTML response, exposing them to any user who can view the page source or network traffic. This allows an attacker to steal session tokens and access tokens, potentially leading to account takeover or unauthorized API access.

Supply Chain & Package Security

This vulnerability affects the npm package @workos-inc/authkit-remix. As an open-source package, it is distributed via the npm registry. Users should verify the integrity of their installed package using npm audit or yarn audit. The lack of a published patch means that downstream consumers must implement their own mitigation until an official fix is released. Organizations should monitor the package repository for updates and consider pinning to a known-safe version if a patch becomes available.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The high confidentiality impact reflects the exposure of sensitive tokens that can be used to impersonate users or access protected resources. The low attack complexity and no required privileges make this a serious threat for any application using the vulnerable library.

Deep Dive & Mechanics

The authkitLoader function in @workos-inc/authkit-remix is designed to handle authentication and session management for Remix applications. In vulnerable versions, the function returns an object containing sealedSession and accessToken as part of its response. When Remix renders the page, these values are included in the HTML source, typically within a <script> tag or as part of the serialized loader data.

An attacker can extract these tokens by:

1. Viewing the page source of any page that uses authkitLoader.
2. Inspecting network responses from the Remix loader endpoint.
3. Using browser developer tools to examine the serialized data.

The accessToken is a bearer token that grants direct access to the WorkOS API, while sealedSession contains session data that can be used to hijack user sessions. The vulnerability does not require any authentication or user interaction, making it exploitable by any visitor to the affected page.

Vulnerable vs. Patched Code

Vulnerable Code (<= 0.14.1):

// In authkitLoader
export async function authkitLoader({ request }: LoaderArgs) {
  const { sealedSession, accessToken, ...rest } = await getSession(request);
  return { sealedSession, accessToken, ...rest };
}

Patched Code (Hypothetical fix):

// In authkitLoader
export async function authkitLoader({ request }: LoaderArgs) {
  const { sealedSession, accessToken, ...rest } = await getSession(request);
  // Only return non-sensitive data
  return { ...rest };
}

The fix involves removing sealedSession and accessToken from the returned object, ensuring they are never serialized into the HTML response. Alternatively, the tokens could be stored in HTTP-only cookies or server-side session storage.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would:

1. Identify a target application using @workos-inc/authkit-remix version <= 0.14.1.
2. Visit any page that uses the authkitLoader function.
3. View the page source or inspect the network response to find the sealedSession and accessToken values.
4. Use the accessToken to make authenticated requests to the WorkOS API, or decode the sealedSession to hijack user sessions.

Example extraction using curl:

curl -s https://target-app.com/some-page | grep -oP '"sealedSession":"[^"]+"' | cut -d'"' -f4

Example session hijacking:

# Assuming the sealedSession is a JWT or similar
curl -H "Cookie: session=<sealedSession>" https://target-app.com/protected-endpoint

Blue Team

To detect exploitation attempts:

1. Monitor for unusual access to pages that use authkitLoader from unauthenticated users.
2. Look for patterns in web server logs where the response body contains sealedSession or accessToken.
3. Implement Content Security Policy (CSP) headers to prevent data exfiltration via inline scripts.
4. Use Web Application Firewall (WAF) rules to block requests that attempt to extract these tokens from responses.

Detection via log analysis:

grep -E 'sealedSession|accessToken' /var/log/nginx/access.log

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP responses containing "sealedSession" or "accessToken" in the body.
  • Unusual API calls to WorkOS endpoints using stolen tokens.
• File IOCs:
  • Presence of @workos-inc/authkit-remix version <= 0.14.1 in package.json.
• Behavioral IOCs:
  • Multiple requests to the same page from different IPs without authentication.
  • Sudden increase in 401/403 errors on protected endpoints.

Detection Engineering

YARA Rule

rule CVE_2025_55009_AuthKit_Token_Exposure {
    meta:
        description = "Detects exposure of sealedSession or accessToken in HTTP responses"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-55009"
    strings:
        $token1 = "sealedSession"
        $token2 = "accessToken"
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-55009 AuthKit Token Exposure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP responses containing sensitive AuthKit tokens
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        response_body|contains:
            - 'sealedSession'
            - 'accessToken'
    condition: selection
falsepositives:
    - Legitimate debugging endpoints
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-55009 AuthKit Token Exposure"; flow:to_client; content:"sealedSession"; http_server_body; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2025-55009 AuthKit Token Exposure"; flow:to_client; content:"accessToken"; http_server_body; sid:1000002; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade @workos-inc/authkit-remix to version > 0.14.1 if a patch is released. If no patch is available, manually modify the authkitLoader function to exclude sealedSession and accessToken from the returned object.
2. Workaround: Use a custom wrapper around authkitLoader that strips sensitive fields before returning data to the client.
3. Long-term: Implement server-side session management where tokens are never exposed to the client. Use HTTP-only cookies for session identifiers.
4. Monitoring: Deploy the detection rules above to identify any existing exposure.
5. Incident Response: If tokens have been exposed, rotate all affected API keys and invalidate user sessions.

Valters IT