CVE-2025-54876: Janssen Project Info Disclosure Flaw

CVE-2025-54876 Overview

CVE-2025-54876 affects the Janssen Project, an open-source identity and access management (IAM) platform. Versions 1.9.0 and below write user passwords and client secrets in plaintext to the local cli_cmd.log file. The logging occurs in the jans-cli-tui component when HTTP client debug output is redirected to the log handler without sanitization. Any actor with read access to the log file can recover credentials transmitted through the CLI. The issue maps to [CWE-522: Insufficiently Protected Credentials] and is fixed in the nightly prerelease.

Critical Impact
Plaintext storage of userPassword and clientSecret values in cli_cmd.log exposes IAM credentials to any local reader of the log file.

Affected Products

Janssen Project jans-cli-tui versions 1.9.0 and below
config_cli.py HTTP client logging path in jans-cli-tui/cli_tui/cli/
Fixed in the Janssen Project nightly prerelease

Discovery Timeline

2025-08-06 - CVE-2025-54876 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54876

Vulnerability Analysis

The Janssen CLI TUI reroutes http.client.print to a debug logger that writes every request line to cli_cmd.log. Request bodies for identity operations include JSON payloads with userPassword and clientSecret fields. Because the logger did not filter these fields, plaintext credentials were persisted on disk each time the CLI issued a send: operation. An attacker with local access, a compromised backup, or read access to the log directory can extract IAM credentials and reuse them against the Janssen deployment. The impact is limited to confidentiality of logged credentials; the flaw does not itself enable remote code execution or authentication bypass.

Root Cause

The root cause is missing input sanitization on debug log output. The print_to_log function joined all arguments and wrote them directly through self.cli_logger.debug, with no redaction for sensitive JSON keys. This is a classic insufficiently protected credentials pattern ([CWE-522]) where diagnostic logging paths bypass the credential handling controls applied elsewhere in the application.

Attack Vector

Exploitation requires access to the host running jans-cli-tui or to any exfiltrated copy of cli_cmd.log. An attacker who reads the file recovers cleartext passwords and client secrets submitted through the CLI. The credentials can then be replayed against the Janssen IAM APIs or downstream systems where the same secrets are reused.

python

# Security patch in jans-cli-tui/cli_tui/cli/config_cli.py
# fix(jans-cli-tui): avoid logging plain texts (#11903)
file_handler.setFormatter(logging.Formatter("%(asctime)s [%(levelname)-5.5s]  %(message)s"))
self.cli_logger.addHandler(file_handler)
def print_to_log(*args):
-   self.cli_logger.debug(" ".join(args))
+   log_args = list(args)
+   # don't log passwords
+   if log_args and log_args[0].startswith('send:'):
+       try:
+           log_data = json.loads(log_args[1].strip("b").strip("'"))
+           for prop in log_data:
+               if prop in ('userPassword', 'clientSecret'):
+                   log_data[prop] = '*****'
+           log_args[1] = str(log_data)
+       except Exception as e:
+           pass
+
+   self.cli_logger.debug(" ".join(log_args))
http.client.print = print_to_log

Source: GitHub commit 3592837. The patch parses each outbound send: payload as JSON and replaces userPassword and clientSecret values with ***** before writing to the log.

Detection Methods for CVE-2025-54876

Indicators of Compromise

Presence of cli_cmd.log entries containing the string send: followed by JSON payloads with userPassword or clientSecret in cleartext.
Unexpected reads, copies, or exfiltration of cli_cmd.log from Janssen administrative hosts.
Off-host copies of cli_cmd.log appearing in backups, ticket attachments, or artifact repositories.

Detection Strategies

Scan cli_cmd.log files across Janssen hosts with a regex such as "(userPassword|clientSecret)"\s*:\s*"[^*] to identify unredacted credentials.
Compare deployed config_cli.py against the patched version to confirm the redaction block is present.
Alert on file access events against cli_cmd.log by processes other than jans-cli-tui.

Monitoring Recommendations

Forward Janssen CLI host filesystem and process telemetry to a centralized analytics platform and retain access events for cli_cmd.log.
Rotate and archive cli_cmd.log frequently, and monitor archives for cleartext credential patterns.
Track authentication anomalies against Janssen IAM APIs for accounts whose credentials may have been logged.

How to Mitigate CVE-2025-54876

Immediate Actions Required

Upgrade jans-cli-tui to the Janssen nightly prerelease that includes commit 3592837.
Rotate every userPassword and clientSecret that may have been submitted through jans-cli-tui on affected versions.
Purge or securely delete existing cli_cmd.log files and any backups containing them.
Restrict filesystem permissions on the Janssen CLI host to the administrative user only.

Patch Information

The fix is delivered in the Janssen nightly prerelease via GitHub Pull Request #11903 and merged in commit 3592837. Refer to GHSA-2f4x-m695-jvp3 and the project discussion for advisory context.

Workarounds

Disable debug logging in jans-cli-tui until the patched build is deployed.
Redirect cli_cmd.log to a directory with 0600 permissions owned by the administrative account.
Manually redact userPassword and clientSecret from any archived logs before sharing or backing them up.

bash

# Post-upgrade cleanup and hardening
sudo shred -u /var/log/jans/cli_cmd.log
sudo install -m 0600 -o jans -g jans /dev/null /var/log/jans/cli_cmd.log
grep -RE '"(userPassword|clientSecret)"\s*:\s*"[^*]' /var/log/jans/ /var/backups/ 2>/dev/null