CVE-2025-65957 Details
Description
Core Bot Is an Open Source discord bot made for maple hospital servers. Prior to commit dffe050, the API keys (SUPABASE_API_KEY, TOKEN) are loaded using environment variables, but there are cases in code (error handling, summaries, webhooks) where configuration summaries may inadvertently leak sensitive data (e.g., by failing to redact data in summary embeds or logs). This issue has been patched via commit dffe050.
A vulnerability exists in Core Bot, an open-source Discord bot for Maple Hospital servers, allowing for the unintentional leakage of sensitive API keys (SUPABASE_API_KEY, TOKEN) through error handling, summaries, and webhooks. Prior to the patch in commit dffe050, the bot's configuration summaries could expose these secrets by failing to properly redact them in summary embeds or logs. This exposure could potentially grant attackers control over the bot or its associated database.
Users are advised to update to the latest version of Core Bot, where this vulnerability has been patched. The update can be obtained from the Core Bot GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 26, 2025CISA-ADP
Assessed Nov 26, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Intercore-Productions/Core-Bot/commit/dffe050d565a580edfcd0242efa45da88ab31260 | [email protected] | Source CodeVendor |
| https://github.com/Intercore-Productions/Core-Bot/security/advisories/GHSA-42j6-x28v-38r8 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Intercore-Productions Core Bot | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 26, 2025 | New CVE Received | [email protected] |