TI-2025-31137 Aliases CVE-2025-49009 GHSA-qx7g-fx8q-545g

Para Inserts Sensitive Information into Log File for Facebook authentication

LOW 27CWE-532Published 2025-06-05 · Updated 2025-06-17

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.

Summary

Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 in `FacebookAuthFilter.java` results in a full request URL being logged during a failed request to a Facebook user profile. The log includes the user's access token in plain text. Since WARN-level logs are often retained in production and accessible to operators or log aggregation systems, this poses a risk of token exposure. Version 1.50.8 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00173 6th percentileScored 2026-11-07

Fix Fixed para (Erudika): 1.50.8com.erudika:para-server (Maven): 1.50.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Erudika	para	before 1.50.8	1.50.8	Patch available	CNA
—	com.erudika:para-server (Maven)	before 1.50.8	1.50.8	Patch available	GHSA-qx7g-fx8q-545g

para VendorErudika Affected before 1.50.8 Fixed in 1.50.8 Patch available CNA
com.erudika:para-server (Maven) Vendor— Affected before 1.50.8 Fixed in 1.50.8 Patch available GHSA-qx7g-fx8q-545g

Remediation

Fix · CNA para (Erudika) Fixed in 1.50.8
Fix · GHSA-qx7g-fx8q-545g com.erudika:para-server (Maven) Fixed in 1.50.8 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-49009
2026-10-03 Alias added: GHSA-qx7g-fx8q-545g

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-49009

Other 3

TI-2026-30501 Missing authentication in Erudika scoold CVSS 3.1MEDIUM 6.7
TI-2026-74990 Scoold accepts forged JWTs as admin, exposing config and logs CVSS 3.1MEDIUM 6.1
TI-2026-28342 Scoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/ask CVSS 3.1MEDIUM 6.5
TI-2026-27076 Scoold: Cross-Account Feedback Deletion (IDOR) CVSS 3.1MEDIUM 6.5
TI-2026-74986 Open redirect in Scoold sign-in lets attackers redirect users CVSS 3.1MEDIUM 5.4
TI-2024-33769 Semicolon Path Injection on API /api;/config CVSS 4.0HIGH 8.7

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences