Critical severity · published Jul 17, 2025
CVE-2025-6391
JSON Web Token (JWT) Exposure in Log Files
9.1
CVSS
0.3%
EPSS
No
On KEV
Description
Brocade ASCG before 3.3.0 logs JSON
Web Tokens (JWT) in log files. An attacker with access to the log files
can withdraw the unencrypted tokens with security implications, such as
unauthorized access, session hijacking, and information disclosure.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
Brocade ASCG · Broadcom
before 3.3.0 · source: vendor
BA
Brocade Active Support Connectivity Gateway · Broadcom
through 3.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-6391
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-6391
Vendor Advisory
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35951
More from Brocade ASCG
9.1
CVE-2025-7398
Medium Strength Cipher Suites detected on port on ports 9000 and 8036
7.1
CVE-2025-7397
CLI history displays inline passwords