PT-2025-4774 · Unknown · Next-Forge

Lukem121 · Published 2025-01-13 · Updated 2025-01-13 · CVE-2025-23027

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions next-forge (affected versions not specified)

Description The issue concerns a Next.js project boilerplate for modern web applications. A BASEHUB TOKEN is committed in the apps/web/.env.example file. Users are advised to avoid using this token and remove any access it may have in their systems.

Recommendations To resolve the issue, users should remove the BASEHUB TOKEN from their systems and avoid using it. As a mitigation measure, consider restricting access to the apps/web/.env.example file to minimize the risk of exploitation. Avoid using the BASEHUB TOKEN in your applications until the issue is resolved.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2025-23027

GHSA-WPPX-QMQH-9H33

Affected Products

Next-Forge

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23027.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-23027 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23027 · Security Note
• https://github.com/haydenbleasel/next-forge/commit/239a98f2c308a51d626ae0613102917f82603c1c · Note
• https://github.com/haydenbleasel/next-forge/security/advisories/GHSA-wppx-qmqh-9h33 · Note
• https://t.me/cvedetector/15170 · Telegram Post
• https://twitter.com/CVEnew/status/1878892346718183433 · Twitter Post