GHSA-62vx-hpcr-m9ch · Severity: medium · Ecosystem: npm — @perfood/couch-auth may expose session tokens, passwords
Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707. This creates a window of opportunity for sensitive data extraction through memory dumps, debugging tools, or other memory access techniques, potentially leading to session hijacking.
Conclusion & alert: CVE-2025-60794 is rated Low Risk (28/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.03%). Mandatory action: Monitor for updates and reassess as exploit intelligence or EPSS changes.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2025-11-21 | — | 0.03% | — |
Full EPSS history (1 record total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 6.5 | 3.1 | MEDIUM |
|
3.9 | 2.5 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
GHSA-62vx-hpcr-m9ch · Severity: medium · Ecosystem: npm — @perfood/couch-auth may expose session tokens, passwords
| URL | Tags |
|---|---|
| https://github.com/perfood/couch-auth | Product |
| https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60794.md | Third Party Advisory |
| https://www.npmjs.com/package/@perfood/couch-auth | Product |