CVE-2025-70949
High · 7.5CVSS
7.5
EPSS
0.4%
Published
Mar 5, 2026
CISA due date
—
The record
An observable timing discrepancy in @perfood/couch-auth v0.26.0 allows attackers to access sensitive information via a timing side-channel.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @perfood/couch-auth | 0 | No fix |
Related vulnerabilities
- GHSA-mjqr-5c55-g77h @perfood/couch-auth has an Observable Timing Discrepancy Same vulnerability
- GHSA-qw8v-34ww-6q9p @perfood/couch-auth has a host header injection vulnerability Also affects @perfood/couch-auth
- CVE-2025-70948 A host header injection vulnerability in the mailer component of @perfood/couch-auth… Also affects @perfood/couch-auth
- GHSA-62vx-hpcr-m9ch @perfood/couch-auth may expose session tokens, passwords Also affects @perfood/couch-auth
- CVE-2025-60794 @perfood/couch-auth may expose session tokens, passwords Also affects @perfood/couch-auth
- CVE-2026-87946 Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows… CWE-208
- CVE-2026-49265 OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. CWE-208
- CVE-2026-77696 Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret… CWE-208