Vulnerability Description
Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707. This creates a window of opportunity for sensitive data extraction through memory dumps, debugging tools, or other memory access techniques, potentially leading to session hijacking.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Perfood | Couchauth | <= 0.21.2 |
Related Weaknesses (CWE)
References
- https://github.com/perfood/couch-authProduct
- https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60794.mdThird Party Advisory
- https://www.npmjs.com/package/@perfood/couch-authProduct
FAQ
What is CVE-2025-60794?
CVE-2025-60794 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707. This creates a window of opportunity for...
How severe is CVE-2025-60794?
CVE-2025-60794 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-60794?
Check the references section above for vendor advisories and patch information. Affected products include: Perfood Couchauth.