PT-2025-48098 · Coreboot · Coreboot

Published 2025-11-25 · Updated 2025-11-26 · CVE-2025-65957

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions Core Bot versions prior to commit dffe050

Description Core Bot, an open source discord bot for maple hospital servers, experienced an issue where API keys (SUPABASE API KEY, TOKEN) loaded from environment variables could be inadvertently leaked through configuration summaries in error handling, summaries, and webhooks. Sensitive data was potentially exposed in summary embeds and logs due to a failure to redact it.

Recommendations Update to commit dffe050 or later to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-65957

GHSA-42J6-X28V-38R8

Affected Products

Coreboot

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65957.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-65957 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65957 · Security Note
• https://github.com/Intercore-Productions/Core-Bot/commit/dffe050d565a580edfcd0242efa45da88ab31260 · Note
• https://github.com/Intercore-Productions/Core-Bot/security/advisories/GHSA-42j6-x28v-38r8 · Note
• https://twitter.com/VulmonFeeds/status/1993581085507166268 · Twitter Post
• https://twitter.com/CVEnew/status/1993467641520947579 · Twitter Post
• https://t.me/cveNotify/144035 · Telegram Post