BaseFortify

Publication date: 2025-11-20

Last updated on: 2025-12-12

Assigner: MITRE

Description

Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707. This creates a window of opportunity for sensitive data extraction through memory dumps, debugging tools, or other memory access techniques, potentially leading to session hijacking.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-20

Last Modified

2025-12-12

Generated

2026-07-06

AI Q&A

2025-11-20

EPSS Evaluated

2026-07-05

NVD

CVE-2025-60794

EUVD

EUVD-2025-198271

Affected Vendors & Products

Vendor	Product	Version / Range
perfood	couchauth	to 0.21.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-316	The product stores sensitive information in cleartext in memory.

Attack-Flow Graph

Executive Summary

In couch-auth version 0.21.2, session tokens and passwords are stored in JavaScript objects and are not explicitly cleared from memory. This means sensitive data remains in memory and can potentially be extracted using memory dumps, debugging tools, or other memory access methods, which could lead to unauthorized access.

Impact Analysis

This vulnerability can lead to session hijacking if an attacker is able to extract session tokens or passwords from memory. This unauthorized access can compromise user accounts and sensitive information.

Hi! I’m here to help you understand CVE-2025-60794. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70