CVE-2025-54876
Jans CLI stores plaintext passwords in the local cli_cmd.log file
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Jans CLI stores plaintext passwords in the local cli_cmd.log file
The Janssen Project is an open-source identity and access management (IAM) platform. In versions 1.9.0 and below, Janssen stores passwords in plaintext in the local cli_cmd.log file. This is fixed in the nightly prerelease.
Reserved 2025-07-31 | Published 2025-08-05 | Updated 2025-08-05 | Assigner GitHub_MCWE-522: Insufficiently Protected Credentials
github.com/...t/jans/security/advisories/GHSA-2f4x-m695-jvp3
github.com/...mmits/5260520e8d7ce1d1b8387c71b3571f20e643f110
github.com/JanssenProject/jans/discussions/11886
Support options
