Para Facebook Authentication Logging Vulnerability Exposing Access Tokens

A vulnerability in Para versions prior to 1.50.8 allows for the logging of sensitive information during Facebook authentication. Specifically, when a request to retrieve a user's profile fails, the access token is included in the log at WARN level, in plain text. This exposure is concerning because such logs are typically retained in production environments and can be accessed by operators or log aggregation systems.

Impact

The vulnerability leads to the unintentional exposure of Facebook access tokens in application logs, where they can be accessed by operators or through log aggregation systems.

Remediation

Users can upgrade to Para version 1.50.8 or later to address this vulnerability.