CVE-2025-60794
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-20

Last updated on: 2025-12-12

Assigner: MITRE

Description
Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707. This creates a window of opportunity for sensitive data extraction through memory dumps, debugging tools, or other memory access techniques, potentially leading to session hijacking.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-20
Last Modified
2025-12-12
Generated
2026-06-16
AI Q&A
2025-11-20
EPSS Evaluated
2026-06-14
NVD
CVE-2025-60794
EUVD
EUVD-2025-198271
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
perfood couchauth to 0.21.2 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-316 The product stores sensitive information in cleartext in memory.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

In couch-auth version 0.21.2, session tokens and passwords are stored in JavaScript objects and are not explicitly cleared from memory. This means sensitive data remains in memory and can potentially be extracted using memory dumps, debugging tools, or other memory access methods, which could lead to unauthorized access.

Impact Analysis

This vulnerability can lead to session hijacking if an attacker is able to extract session tokens or passwords from memory. This unauthorized access can compromise user accounts and sensitive information.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-60794. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart