CVE-2025-60794
High · 7.5@perfood/couch-auth may expose session tokens, passwords
CVSS
7.5
EPSS
0.2%
Published
Nov 20, 2025
CISA due date
—
The record
Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707. This creates a window of opportunity for sensitive data extraction through memory dumps, debugging tools, or other memory access techniques, potentially leading to session hijacking.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @perfood/couch-auth | 0 | No fix |
Related vulnerabilities
- GHSA-62vx-hpcr-m9ch @perfood/couch-auth may expose session tokens, passwords Same vulnerability
- GHSA-mjqr-5c55-g77h @perfood/couch-auth has an Observable Timing Discrepancy Also affects @perfood/couch-auth
- GHSA-qw8v-34ww-6q9p @perfood/couch-auth has a host header injection vulnerability Also affects @perfood/couch-auth
- CVE-2025-70948 A host header injection vulnerability in the mailer component of @perfood/couch-auth… Also affects @perfood/couch-auth
- CVE-2025-70949 An observable timing discrepancy in @perfood/couch-auth v0.26.0 allows attackers to… Also affects @perfood/couch-auth
- CVE-2026-77407 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. CWE-316
- CVE-2026-53604 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. CWE-316
- CVE-2026-75137 UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that… CWE-316