Medium
Jans CLI stores plaintext passwords in the local cli_cmd.log file
Type: advisorySources: OSV
The Janssen Project is an open-source identity and access management (IAM) platform. In versions 1.9.0 and below, Janssen stores passwords in plaintext in the local cli_cmd.log file. This is fixed in the nightly prerelease.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-54876
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 20:03 UTC · Revision 1
Source evidence
Jans CLI stores plaintext passwords in the local cli_cmd.log file
core-osv · Original sourcePublished 5 Aug 2025, 23:35 UTC
The Janssen Project is an open-source identity and access management (IAM) platform. In versions 1.9.0 and below, Janssen stores passwords in plaintext in the local cli_cmd.log file. This is fixed in the nightly prerelease.
osv:CVE-2025-54876
Complete source record
{
"id": "e8a1ad611b06189cb9f8d2b7fb271baab0db3eda2a1a18ebe06b4b6cdc20217b",
"url": "https://osv.dev/vulnerability/CVE-2025-54876",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Jans CLI stores plaintext passwords in the local cli_cmd.log file",
"summary": "The Janssen Project is an open-source identity and access management (IAM) platform. In versions 1.9.0 and below, Janssen stores passwords in plaintext in the local cli_cmd.log file. This is fixed in the nightly prerelease.",
"evidence": "osv:CVE-2025-54876",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2025-54876",
"aliases": [
"CVE-2025-54876",
"GHSA-2f4x-m695-jvp3"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/janssenproject/jans",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "3592837764fe48b956e3140ca17b8ef7cac00a47"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "1.9.0"
}
],
"source": "DESCRIPTION"
},
{
"range": [
{
"fixed": "3592837764fe48b956e3140ca17b8ef7cac00a47"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v1.9.0",
"v1.8.0",
"v1.7.0",
"v1.6.0",
"v1.5.0",
"v1.4.0",
"v1.3.0",
"v1.2.0",
"v1.1.6",
"v1.0.0-beta.16",
"docker-jans-persistence-loader-v1.0.0-beta.16",
"docker-jans-client-api-v1.0.0-beta.16",
"docker-jans-certmanager-v1.0.0-beta.16",
"docker-jans-fido2-v1.0.0-beta.16",
"docker-jans-scim-v1.0.0-beta.16",
"docker-jans-configurator-v1.0.0-beta.16",
"docker-jans-auth-server-v1.0.0-beta.16",
"docker-jans-config-api-v1.0.0-beta.16",
"docs-v1.0.0-beta.16",
"jans-auth-server-v1.0.0-beta.16",
"jans-config-api-v1.0.0-beta.16",
"jans-cli-v1.0.0-beta.16",
"jans-pycloudlib-v1.0.0-beta.16",
"jans-linux-setup-v1.0.0-beta.16",
"jans-fido2-v1.0.0-beta.16",
"jans-eleven-v1.0.0-beta.16",
"jans-bom-v1.0.0-beta.16",
"jans-core-v1.0.0-beta.16",
"jans-client-api-v1.0.0-beta.16",
"jans-orm-v1.0.0-beta.16",
"jans-scim-v1.0.0-beta.16",
"jans-notify-v1.0.0-beta.16",
"v1.0.0-beta.15",
"docker-jans-configurator-v1.0.0-beta.15",
"docker-jans-fido2-v1.0.0-beta.15",
"docker-jans-config-api-v1.0.0-beta.15",
"docker-jans-auth-server-v1.0.0-beta.15",
"docker-jans-certmanager-v1.0.0-beta.15",
"docker-jans-scim-v1.0.0-beta.15",
"docker-jans-client-api-v1.0.0-beta.15",
"docker-jans-persistence-loader-v1.0.0-beta.15",
"jans-pycloudlib-v1.0.0-beta.15",
"jans-notify-v1.0.0-beta.15",
"jans-orm-v1.0.0-beta.15",
"jans-config-api-v1.0.0-beta.15",
"jans-client-api-v1.0.0-beta.15",
"jans-core-v1.0.0-beta.15",
"jans-bom-v1.0.0-beta.15",
"jans-auth-server-v1.0.0-beta.15",
"jans-fido2-v1.0.0-beta.15",
"jans-scim-v1.0.0-beta.15",
"jans-linux-setup-v1.0.0-beta.15",
"jans-cli-v1.0.0-beta.15",
"docs-v1.0.0-beta.15",
"jans-eleven-v1.0.0-beta.15",
"charts-v1.0.0-beta.14",
"docker-jans-certmanager-v1.0.0-beta.14",
"docker-jans-client-api-v1.0.0-beta.14",
"docker-jans-scim-v1.0.0-beta.14",
"docker-jans-auth-server-v1.0.0-beta.14",
"docker-jans-config-api-v1.0.0-beta.14",
"docker-jans-fido2-v1.0.0-beta.14",
"docker-jans-persistence-loader-v1.0.0-beta.14",
"docker-jans-configurator-v1.0.0-beta.14",
"jans-pycloudlib-v1.0.0-beta.14",
"docker-jans-configurator-v1.0.0-beta.13",
"docker-jans-config-api-v1.0.0-beta.13",
"docker-jans-certmanager-v1.0.0-beta.13",
"docker-jans-client-api-v1.0.0-beta.13",
"docker-jans-fido2-v1.0.0-beta.13",
"docker-jans-auth-server-v1.0.0-beta.13",
"docker-jans-scim-v1.0.0-beta.13",
"docker-jans-persistence-loader-v1.0.0-beta.13",
"jans-pycloudlib-v1.0.0-beta.13",
"1.0.0-a4",
"1.0.0-a3",
"v1.0.0-a2",
"v1.0.0-a1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54876.json"
}
}
],
"modified": "2026-10-28T02:30:23.172818232Z",
"provider": "osv",
"references": [
"https://github.com/JanssenProject/jans/discussions/11886",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54876.json",
"https://github.com/JanssenProject/jans/security/advisories/GHSA-2f4x-m695-jvp3",
"https://nvd.nist.gov/vuln/detail/CVE-2025-54876",
"https://github.com/JanssenProject/jans/commit/3592837764fe48b956e3140ca17b8ef7cac00a47",
"https://github.com/JanssenProject/jans/pull/11903"
],
"provider_metadata": {
"cwe_ids": [
"CWE-522"
],
"cna_assigner": "GitHub_M",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"fixed": "nightly"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54876.json"
}
},
"related_cves": [
{
"value": "CVE-2025-54876",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 489561,
"published_at": "2025-08-05T23:35:51.9+00:00"
}