PT-2025-31153 · Mongodb+1 · Mongodb Atlas+1

Published 2025-07-28 · Updated 2025-07-28 · CVE-2025-54428

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RevelaCode versions prior to 1.0.1

Description RevelaCode is an AI-powered faith-tech project that decodes biblical verses, prophecies and global events into accessible language. A valid MongoDB Atlas URI with embedded username and password was accidentally committed to the public repository in versions prior to 1.0.1. This could allow unauthorized access to production or staging databases, potentially leading to data exfiltration, modification, or deletion.

Recommendations Versions prior to 1.0.1: Immediately rotate credentials for the exposed database user. Versions prior to 1.0.1: Use a secret manager instead of storing secrets directly in code. Versions prior to 1.0.1: Audit recent access logs for suspicious activity.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2025-54428

GHSA-M253-QVCR-CR48

Affected Products

Mongodb Atlas

Revelacode

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54428.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-54428 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54428 · Security Note
• https://github.com/musombi123/RevelaCode-Backend/security/advisories/GHSA-m253-qvcr-cr48 · Note
• https://github.com/musombi123/RevelaCode-Backend/commit/95005cf4bacf1b005aef9d4b8e85237c98492d83 · Note
• https://t.me/CVEtracker/28619 · Telegram Post
• https://twitter.com/CVEnew/status/1949937452300341692 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1949975078038352235 · Twitter Post