CVE-2025-60794
Unknown
Unknown - Not Provided
BaseFortify
Publication date: 2025-11-20
Last updated on: 2025-12-12
Assigner: MITRE
Description
Description
Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707. This creates a window of opportunity for sensitive data extraction through memory dumps, debugging tools, or other memory access techniques, potentially leading to session hijacking.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| perfood | couchauth | to 0.21.2 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-316 | The product stores sensitive information in cleartext in memory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
In couch-auth version 0.21.2, session tokens and passwords are stored in JavaScript objects and are not explicitly cleared from memory. This means sensitive data remains in memory and can potentially be extracted using memory dumps, debugging tools, or other memory access methods, which could lead to unauthorized access.
How can this vulnerability impact me? :
This vulnerability can lead to session hijacking if an attacker is able to extract session tokens or passwords from memory. This unauthorized access can compromise user accounts and sensitive information.
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70