CVE-2025-6391: JSON Web Token (JWT) Exposure in Log Files
Published Jul 17, 2025
·Updated
Brocade ASCG before 3.3.0 logs JSON Web Tokens (JWT) in log files. An attacker with access to the log files can withdraw the unencrypted tokens with security implications, such as unauthorized access, session hijacking, and information disclosure.
Affected Software
2 affected components
Brocade ASCG<3.3.0
Broadcom Brocade Active Support Connectivity Gateway<=3.2.0
Event History
Jul 17, 2025
CVE Published
via MITRE·09:45 PM
Data Sourced
via MITRE·09:45 PM
DescriptionWeakness
Data Sourced
via NVD·10:15 PM
DescriptionSeverityWeaknessAffected Software
Dec 16, 58232
Event
via NVD·11:36 AM
Frequently Asked Questions
1
What is the severity of CVE-2025-6391?
CVE-2025-6391 is considered critical due to the potential for unauthorized access and session hijacking.
2
How can I fix CVE-2025-6391?
To mitigate CVE-2025-6391, upgrade to Brocade ASCG version 3.3.0 or later.
3
What are the potential risks associated with CVE-2025-6391?
The risks include unauthorized access to sensitive data, session hijacking, and potential information disclosure.
4
Which versions of Brocade ASCG are affected by CVE-2025-6391?
Brocade ASCG versions prior to 3.3.0 are affected by CVE-2025-6391.
5
How does CVE-2025-6391 allow attackers to access sensitive information?
CVE-2025-6391 allows attackers to access unencrypted JSON Web Tokens logged in files, leading to security breaches.