PT-2025-47578 · Unknown · Couch-Auth

Published 2025-11-20 · Updated 2025-12-12 · CVE-2025-60794

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions couch-auth version 0.21.2

Description Session tokens and passwords are stored in JavaScript objects within the software and are not explicitly cleared from memory. This occurs in src/user.ts lines 700-707, creating a potential for sensitive data extraction through memory dumps, debugging tools, or other memory access techniques, which could lead to session hijacking.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the user.ts file to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-316

Related Identifiers

CVE-2025-60794

GHSA-62VX-HPCR-M9CH

Affected Products

Couch-Auth

References · 9

• 🔥 https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60794.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-60794 · Security Note
• https://osv.dev/vulnerability/CVE-2025-60794 · Vendor Advisory
• https://github.com/perfood/couch-auth · Note
• https://npmjs.com/package/@perfood/couch-auth · Note
• https://t.me/CVEtracker/37821 · Telegram Post
• https://t.me/cveNotify/145623 · Telegram Post
• https://twitter.com/CVEnew/status/1991526232597622924 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1p2foxr/resumen_diario_de_vulnerabilidades_20112025 · Reddit Post