musombi123 RevelaCode-Backend up to 1.0.0 insufficiently protected credentials

Summaryinfo

A vulnerability, which was classified as problematic, was found in musombi123 RevelaCode-Backend up to 1.0.0. This issue affects some unknown processing. The manipulation results in insufficiently protected credentials. This vulnerability is known as CVE-2025-54428. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in musombi123 RevelaCode-Backend up to 1.0.0. Affected is some unknown functionality. The manipulation with an unknown input leads to a insufficiently protected credentials vulnerability. CWE is classifying the issue as CWE-522. The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. This is going to have an impact on confidentiality. CVE summarizes:

RevelaCode is an AI-powered faith-tech project that decodes biblical verses, prophecies and global events into accessible language. In versions below 1.0.1, a valid MongoDB Atlas URI with embedded username and password was accidentally committed to the public repository. This could allow unauthorized access to production or staging databases, potentially leading to data exfiltration, modification, or deletion. This is fixed in version 1.0.1. Workarounds include: immediately rotating credentials for the exposed database user, using a secret manager (like Vault, Doppler, AWS Secrets Manager, etc.) instead of storing secrets directly in code, or auditing recent access logs for suspicious activity.

The advisory is available at github.com. This vulnerability is traded as CVE-2025-54428 since 07/22/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1552 by the MITRE ATT&CK project.

Upgrading to version 1.0.1 eliminates this vulnerability. Applying the patch 95005cf4bacf1b005aef9d4b8e85237c98492d83 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• musombi123

Name

• RevelaCode-Backend

Version

• 1.0

License

• open-source

Website

• Product: https://github.com/musombi123/RevelaCode-Backend/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion