Vulnerability in Para Backend Server Affects User Access Tokens

CVE-2025-49009

What is CVE-2025-49009?

A security vulnerability in the Para backend server framework, specifically in the 'FacebookAuthFilter.java' component, allows for the logging of full request URLs during failed attempts to access Facebook user profiles. This exposure includes sensitive user access tokens in plain text format. Given that WARN-level logs are often retained in production environments, this raises significant security concerns, as such logs may be accessible to operators or integrated log management systems. The issue is addressed in version 1.50.8.

References