PT-2025-10591 · Unknown · Tap&Sign App

Mucahit Ic · Published 2025-03-10 · Updated 2025-09-12 · CVE-2024-12604

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tap&Sign App versions prior to V.1.025

Description The issue concerns a Weak Password Recovery Mechanism for Forgotten Password, allowing password recovery exploitation and functionality misuse in the Tap&Sign App. It also involves cleartext storage of sensitive information in an environment variable.

Recommendations For versions prior to V.1.025, update to version V.1.025 or later to resolve the issue. As a temporary workaround, consider restricting access to the password recovery mechanism until the update is applied. Avoid using the password recovery feature in the affected versions to minimize the risk of exploitation.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-640

CWE-526

CWE-312

Related Identifiers

CVE-2024-12604

Affected Products

Tap&Sign App

References · 13

• https://osv.dev/vulnerability/CVE-2024-12604 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12604 · Security Note
• https://usom.gov.tr/bildirim/tr-25-0063 · Note
• https://twitter.com/cybercronai/status/1899476777547776290 · Twitter Post
• https://twitter.com/CVEnew/status/1899111152346370361 · Twitter Post
• https://t.me/cvedetector/19974 · Telegram Post
• https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0063 · Note
• https://t.me/cveNotify/135210 · Telegram Post
• https://t.me/cvetracker/18810 · Telegram Post
• https://t.me/cvenotify/114073 · Telegram Post
• https://twitter.com/cracbot/status/1900502257994797335 · Twitter Post
• https://docs.tapandsign.com/tap-and-sign/tap-and-sign-v.1.025-surum-notlari · Note
• https://twitter.com/cracbot/status/1900864641099854278 · Twitter Post