CVE-2025-40680 Encryption of sensitive data in CapillaryScope missing
Local attackers can read proxy credentials and JWT tokens from the Windows registry due to lack of encryption in CapillaryScope.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-40680?
CVE-2025-40680 is a medium-severity vulnerability in CapillaryScope, published on 24 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Lack of sensitive data encryption in CapillaryScope v2.5.0 of Capillary io, which stores both the proxy credentials and the JWT session token in plain text within different registry keys on the Windows operating system. Any authenticated local user with read access to the registry can extract these sensitive values.
Weakness: CWE-311
Which versions are affected by CVE-2025-40680?
How do I fix CVE-2025-40680?
No fix has been published for CVE-2025-40680 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-40680 being exploited?
There is no known exploitation of CVE-2025-40680 in the wild and no public exploit code.
Sources
Also known as GHSA-3g73-h9cm-2486.