https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 01:40:43 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-249396 EUVD-2026-249396 https://cve.radiocsirt.org/vuln/euvd-2026-249396 https://cve.radiocsirt.org/vuln/fkie_cve-2025-55009 <p>The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS &amp; AuthKit with Remix. In versions 0.14.1 and below, @workos-inc/authkit-remix exposed sensitive authentication artifacts — specifically sealedSession and accessToken — by returning them from the authkitLoader. This caused them to be rendered into the browser HTML.</p> <p>The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS &amp; AuthKit with Remix. In versions 0.14.1 and below, @workos-inc/authkit-remix exposed sensitive authentication artifacts — specifically sealedSession and accessToken — by returning them from the authkitLoader. This caused them to be rendered into the browser HTML.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-55009 https://cve.radiocsirt.org/vuln/ghsa-v3gr-w9gf-23cx <p><strong>Affected:</strong> npm: @workos-inc/authkit-remix</p> <p>### Summary</p> <p>Before `0.15.0`, `@workos-inc/authkit-remix` returned sensitive authentication artifacts from the `authkitLoader`, specifically `sealedSession` and `accessToken`. Because these values were returned from the loader, they were embedded into the server-rendered HTML and became readable by any script with access to the page’s DOM (e.g., in the presence of XSS or a malicious browser extension).</p> <p>* **Impact:** Exposure of these secrets can lead to session hijacking and unauthorized API access. * **Fix:** Version `0.15.0` changes the default behavior so the loader no longer returns `sealedSession`/`accessToken`. A secure server-side mechanism is provided to fetch an access token when needed.</p> <p>### Patches</p> <p>Patched in [v0.15.0](https://github.com/workos/authkit-remix/releases/tag/v0.15.0).</p> <p><strong>Affected:</strong> npm: @workos-inc/authkit-remix</p> <p>### Summary</p> <p>Before `0.15.0`, `@workos-inc/authkit-remix` returned sensitive authentication artifacts from the `authkitLoader`, specifically `sealedSession` and `accessToken`. Because these values were returned from the loader, they were embedded into the server-rendered HTML and became readable by any script with access to the page’s DOM (e.g., in the presence of XSS or a malicious browser extension).</p> <p>* **Impact:** Exposure of these secrets can lead to session hijacking and unauthorized API access. * **Fix:** Version `0.15.0` changes the default behavior so the loader no longer returns `sealedSession`/`accessToken`. A secure server-side mechanism is provided to fetch an access token when needed.</p> <p>### Patches</p> <p>Patched in [v0.15.0](https://github.com/workos/authkit-remix/releases/tag/v0.15.0).</p> https://cve.radiocsirt.org/vuln/ghsa-v3gr-w9gf-23cx