CVE-2025-49009 | BDVDB-2026-281168 Detail

Description#

Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 in `FacebookAuthFilter.java` results in a full request URL being logged during a failed request to a Facebook user profile. The log includes the user's access token in plain text. Since WARN-level logs are often retained in production and accessible to operators or log aggregation systems, this poses a risk of token exposure. Version 1.50.8 fixes the issue.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12025-06-05Record published in the CVE List.
2. Version 22025-06-17Most recent update recorded in the CVE List.