What is CVE-2025-54428?

CVE-2025-54428 is a critical-severity vulnerability in Musombi123 Revelacode-Backend, classified under Insufficiently Protected Credentials. CVSS score: 9.8/10. Published 2025-07-28.

How severe is CVE-2025-54428?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Musombi123 Revelacode-Backend

CVE-2025-54428

RevelaCode is an AI-powered faith-tech project that decodes biblical verses, prophecies and global events into accessible language. In versions below 1.0.1, a valid MongoDB Atlas URI with embedded username and password was accidentally committed to the public repository. This could allow unauthorized access to production or staging databases, potentially leading to data exfiltration, modification, or deletion. This is fixed in version 1.0.1. Workarounds include: immediately rotating credentials for the exposed database user, using a secret manager (like Vault, Doppler, AWS Secrets Manager, etc.) instead of storing secrets directly in code, or auditing recent access logs for suspicious activity.

EPSS: 0.005 (37.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Musombi123 Revelacode-backend — versions < 1.0.1

Weakness classification (CWE)

CWE-522 — Insufficiently Protected Credentials

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2025-54428?: CVE-2025-54428 is a critical-severity vulnerability in Musombi123 Revelacode-Backend, classified under Insufficiently Protected Credentials. CVSS score: 9.8/10. Published 2025-07-28.
How severe is CVE-2025-54428?: Critical severity. CVSS v3 base score is 9.8 out of 10.