CVE-2025-49009

Para’s CVE-2025-49009 affects the Para server (Facebook authentication flow) via FacebookAuthFilter.java, where a failed request to Facebook’s profile endpoint logs the full URL including the user’s access token in plaintext. The issue exists in versions prior to 1.50.8 and is mitigated by upgrad...

PT-2025-23499 · Para · Para

Name of the Vulnerable Software and Affected Versions: Para versions prior to 1.50.8 Description: A vulnerability exists in Para, a multitenant backend server/framework for object persistence and retrieval, which exposes both access and secret keys in logs without redaction. These credentials are...