CVE-2025-60794 Details
Description
Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707. This creates a window of opportunity for sensitive data extraction through memory dumps, debugging tools, or other memory access techniques, potentially leading to session hijacking.
A vulnerability in Couch-Auth version 0.21.2 allows for sensitive data exposure, as session tokens and passwords are stored in JavaScript objects and remain in memory without explicit clearing. This issue creates a potential window for data extraction through memory dumps, debugging tools, or other memory access techniques, which could lead to session hijacking.
Users can update to Couch-Auth version 0.25.0, which addresses this vulnerability by clearing session tokens and passwords from memory after use.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 20, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/perfood/couch-auth | [email protected] | Product |
| https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60794.md | [email protected] | Third Party Advisory |
| https://www.npmjs.com/package/@perfood/couch-auth | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-316 | Cleartext Storage of Sensitive Information in Memory | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| perfood couchauth | <= 0.21.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 12, 2025 | Initial Analysis | [email protected] |
| Nov 20, 2025 | CVE Modified | CISA-ADP |
| Nov 20, 2025 | New CVE Received | [email protected] |