Turms Server CVE-2025-66910

Requires local access to the host running Turms Server v0.10.0-SNAPSHOT or earlier with privileges sufficient to read the JVM process memory (via memory dump, heap analysis, or debugger attachment). The specific condition that creates exposure is that BaseAdminService caches a successfully authenticated administrator's raw password in the rawPassword field of AdminInfo in memory as a performance optimization - so at least one administrator must have logged in during the process lifetime for a credential to be present. Limiting factors that reduce realistic risk: no remote attack vector, a required pre-existing high-privilege local foothold, no user interaction of the victim, and exposure limited to the credentials of admins who have authenticated since the server started.

This is a genuine but constrained, lower-priority issue - not a drop-everything flaw despite the Confidentiality/Integrity 'High' ratings. The CVSS vector (AV:L/AC:L/PR:H/UI:N, base 6.0) is internally consistent with the description: exploitation requires local access to the host and high privileges, since reading another process's memory via a dump, heap analysis, or debugger attachment presupposes an attacker who already has substantial control of the system. EPSS and SSVC data were not provided in the input, so exploitation-probability and automatability signals are unavailable. The vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation; however a public exploit/report does exist (Xzzz111 report on GitHub), so publicly available exploit code exists. The key tension is that an attacker who meets the PR:H/AV:L prerequisite (root or equivalent on the host) can usually already read arbitrary secrets anyway - this flaw mainly adds value by exposing plaintext admin passwords that would otherwise be protected by bcrypt and could be reused on other systems. Net: legitimate defense-in-depth defect, but real-world urgency is low absent remote exploitability.

An attacker who has already obtained high-privilege local access to a host running Turms Server attaches a debugger or captures a heap/process memory dump of the running JVM, then reads the rawPassword field in cached AdminInfo objects to recover administrator credentials in cleartext, defeating the bcrypt-at-rest protection. A public report demonstrating the issue exists. The recovered plaintext passwords are most dangerous when reused across other administrative interfaces or systems.