{"id":"CVE-2025-49009","summary":"Para Inserts Sensitive Information into Log File for Facebook authentication","details":"Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 in `FacebookAuthFilter.java` results in a full request URL being logged during a failed request to a Facebook user profile. The log includes the user's access token in plain text. Since WARN-level logs are often retained in production and accessible to operators or log aggregation systems, this poses a risk of token exposure. Version 1.50.8 fixes the issue.","aliases":["GHSA-qx7g-fx8q-545g"],"modified":"2026-08-12T14:52:40.917063Z","published":"2025-06-05T16:40:27.978Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-532"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49009.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49009.json"},{"type":"ADVISORY","url":"https://github.com/Erudika/para/security/advisories/GHSA-qx7g-fx8q-545g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49009"},{"type":"FIX","url":"https://github.com/Erudika/para/commit/46a908d887da02037384193f70a69345f04887cf"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/erudika/para","events":[{"introduced":"0"},{"fixed":"46a908d887da02037384193f70a69345f04887cf"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.50.8"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.50.7","v1.50.6","v1.50.5","v1.50.4","v1.50.3","v1.50.2","v1.50.1","v1.50.0","v1.49.5","v1.49.4","v1.49.3","v","v1.49.2","v1.49.1","v1.49.0","v1.48.2","v1.48.1","v1.48.0","v1.47.2","v1.47.1","v1.47.0","v1.46.3","v1.46.2","v1.46.1","v1.46.0","v1.45.10","v1.45.9","v1.45.8","v1.45.7","v1.45.6","v1.45.5","v1.45.4","v1.45.3","v1.45.2","v1.45.1","v1.45.0","v1.44.0","v1.43.4","v1.43.3","v1.43.2","v1.43.1","v1.43.0","v1.42.2","v1.42.1","v1.42.0","v1.41.3","v1.41.2","v1.41.1","v1.41.0","v1.40.0","v1.39.1","v1.39.0","v1.38.4","v1.38.3","v1.38.2","v1.38.1","v1.38.0","v1.37.1","v1.37.0","v1.36.1","v1.36.0","v1.35.0","v1.34.3","v1.34.2","v1.34.1","v1.34.0","v1.33.1","v1.33.0","v1.32.0","v1.31.3","v1.31.2","v1.31.1","v1.31.0","v1.30.2","v1.30.1","v1.30.0","v1.29.2","v1.29.1","v1.29.0","v1.28.5","v1.28.4","v1.28.3","v1.28.2","v1.28.1","v1.28.0","v1.27.0","v1.26.2","v1.26.1","v1.26.0","v1.25.5","v1.25.4","v1.25.3","v1.25.2","v1.25.1","v1.25.0","v1.24.5","v1.24.4","v1.24.3","v1.24.2","v1.24.1","v1.24.0","v1.23.1","v1.23.0","v1.22.0","v1.21.1","v1.21.0","v1.20.0","v1.19.0","v1.18.9","v1.18.8","v1.18.7","v1.18.6","v1.18.5","v1.18.4","v1.18.3","v1.18.2","v1.18.1","v1.18.0","v1.17.1","v1.17","v1.16.2","v1.16.1","v1.16","v1.15","v1.14.1","v1.14","v1.13","v1.12","v1.11","v1.10","v1.9.1","v1.9.0","v1.8.0","v1.7.0","v1.6.1","v1.6.0","v1.5.1","v1.5.0","v1.4.0","v1.3.1","v1.3.0","v1.2.1","v1.1.3","v1.1.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49009.json","vanir_signatures_modified":"2026-08-12T14:52:40Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/erudika/para/commit/46a908d887da02037384193f70a69345f04887cf","target":{"file":"para-server/src/main/java/com/erudika/para/server/security/filters/FacebookAuthFilter.java"},"deprecated":false,"digest":{"line_hashes":["221756787732494296186698735855426779241","334472501430535408792439270683118883421","133134948666214475033127404993733539854","315273901633042068046095110795413498231","63457297723310223471067558795285366609","217724055908316639016392933766996179522","60362063882420089238377433360812434332","245143902939329605036680733421210465031","135204739699243333960532562511878283759","207309211928134830509454584963824275172","64865666378711904230181513864653301697","255435830912804690894154230382521036675","89671463414069963904465848980645185956"],"threshold":0.9},"id":"CVE-2025-49009-5788f816","signature_type":"Line"},{"digest":{"function_hash":"303408255284054743209388856865897914834","length":1865},"id":"CVE-2025-49009-a4a88d09","signature_type":"Function","signature_version":"v1","source":"https://github.com/erudika/para/commit/46a908d887da02037384193f70a69345f04887cf","target":{"file":"para-server/src/main/java/com/erudika/para/server/security/filters/FacebookAuthFilter.java","function":"getOrCreateUser"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}