PT-2026-23512 · Unknown · @Perfood/Couch-Auth

Published 2026-03-05 · Updated 2026-04-27 · CVE-2025-70949

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions @perfood/couch-auth version 0.26.0

Description A timing discrepancy exists in @perfood/couch-auth version 0.26.0 that could allow attackers to access sensitive information through a timing side-channel.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-208

Related Identifiers

CVE-2025-70949

GHSA-MJQR-5C55-G77H

Affected Products

@Perfood/Couch-Auth

References · 11

• https://osv.dev/vulnerability/GHSA-mjqr-5c55-g77h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-70949 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-70949 · Security Note
• https://github.com/perfood/couch-auth · Note
• https://t.me/cveNotify/154490 · Telegram Post
• https://gist.github.com/0xHunterr/38aab644874ca9f4646524c5b01cfe5e · Note
• https://twitter.com/VulmonFeeds/status/2029712638452629701 · Twitter Post
• https://twitter.com/giuseppe_1337/status/2048848961729855492 · Twitter Post
• https://twitter.com/HunterXReda/status/2033596144601710991 · Twitter Post
• https://npmjs.com/package/@perfood/couch-auth · Note
• https://twitter.com/CVEnew/status/2031137193939579218 · Twitter Post