CVE-2025-66910 Details

A vulnerability exists in Turms Server in versions through v0.10.0-SNAPSHOT, where administrator passwords are cached in plaintext memory, violating security best practices. This vulnerability allows attackers with local system access to extract these passwords, bypassing bcrypt protection. The issue arises because the BaseAdminService class stores raw passwords unencrypted in AdminInfo objects to enhance authentication efficiency. While passwords are hashed for database storage, successful logins result in plaintext passwords being retained in memory. This creates multiple exposure vectors, including memory dumps, process debugging, and potential serialization of the cached data, all of which could lead to unauthorized access to administrator credentials.

It is recommended to remove the plaintext password caching entirely. After authentication, issue a short-lived JWT token instead of re-validating the password for subsequent requests. Additionally, the rawPassword field should be removed from the AdminInfo class.