CVE-2025-6391
JSON Web Token (JWT) Exposure in Log Files
- State
- Published
- Severity
- 7.1 High
- Published
- Jul 17, 2025
- Updated
- Jul 18, 2025
- Reserved
- Jun 20, 2025
Description
Brocade ASCG before 3.3.0 logs JSON Web Tokens (JWT) in log files. An attacker with access to the log files can withdraw the unencrypted tokens with security implications, such as unauthorized access, session hijacking, and information disclosure.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | brocade |
Weaknesses
- CWE-532 Insertion of Sensitive Information into Log File
Affected Products
| Product | Versions |
|---|---|
Brocade ASCGBroadcom |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.