Jans CLI stores plaintext passwords in the local cli_cmd.log file

CVE Details

Basic Information

Title Jans CLI stores plaintext passwords in the local cli_cmd.log file
Type cve
Published 2025-08-05T23:35:51.900Z
Modified 2025-08-05T23:35:51.900Z

Product Information

Vendor JanssenProject
Product jans
Version < nightly

CVSS Information

Base Score 6.9 (MEDIUM)
Attack Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

AI Analysis

AI Description The JanssenProject’s Jans CLI stored passwords in plaintext within the local cli_cmd.log file in versions 1.9.0 and below. This vulnerability has been fixed in a nightly prerelease.
AI Severity Medium
AI Vendor JanssenProject
AI Product Jans
AI Version 1.9.0 and below

Affected Products

  • JanssenProject jans < nightly

Additional Information

CWE List CWE-522
Source GitHub_M

Description

The Janssen Project is an open-source identity and access management (IAM) platform. In versions 1.9.0 and below, Janssen stores passwords in plaintext in the local cli_cmd.log file. This is fixed in the nightly prerelease.

💭 Join the Security Discussion

🔒 Your email address will not be published. Required fields are marked *

⚠️ Please be respectful and constructive in your comments. Security discussions should remain professional.