https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T18:31:07.351526+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-249395 EUVD-2026-249395 2026-10-07T18:31:07.427577+00:00 EUVD-2026-249395 https://cve.radiocsirt.org/vuln/fkie_cve-2025-55008 fkie_cve-2025-55008 2026-10-07T18:31:07.427633+00:00

The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router. In versions 0.6.1 and below, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically sealedSession and accessToken by returning them from the authkitLoader. This caused them to be rendered into the browser HTML. This issue is fixed in version 0.7.0.

 https://cve.radiocsirt.org/vuln/ghsa-vqvc-9q8x-vmq6 GHSA-vqvc-9q8x-vmq6 — The AuthKit React Router Library rendered sensitive auth data in HTML 2026-10-07T18:31:07.427692+00:00

Affected: npm: @workos-inc/authkit-react-router

In versions before `0.7.0`, `@workos-inc/authkit-react-router` exposed sensitive authentication artifacts — specifically `sealedSession` and `accessToken` by returning them from the `authkitLoader`. This caused them to be rendered into the browser HTML.

### Impact This information disclosure could lead to session hijacking in environments where cross-site scripting (XSS), malicious browser extensions, or local inspection is possible. ### Patches Patched in [https://github.com/workos/authkit-react-router/releases/tag/v0.7.0](https://github.com/workos/authkit-react-router/releases/tag/v0.7.0)

In patched versions: - `sealedSession` and `accessToken` are no longer returned by default from the `authkitLoader`. - A secure server-side mechanism is provided to fetch an access token as needed.