RevelaCode exposes Sensitive MongoDB Atlas URI in .env (potential credential leak)

published 2025-07-28 15 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-22952

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits: 0; none known

RevelaCode is an AI-powered faith-tech project that decodes biblical verses, prophecies and global events into accessible language. In versions below 1.0.1, a valid MongoDB Atlas URI with embedded username and password was accidentally committed to the public repository. This could allow unauthorized access to production or staging databases, potentially leading to data exfiltration, modification, or deletion. This is fixed in version 1.0.1. Workarounds include: immediately rotating credentials for the exposed database user, using a secret manager (like Vault, Doppler, AWS Secrets Manager, etc.) instead of storing secrets directly in code, or auditing recent access logs for suspicious activity.

Patch / fix

links 1

github.com/musombi123/RevelaCode-Backend@95005cf commit

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 15 mo ago (2025-07-28)

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

musombi123 RevelaCode-Backend

Classification

Weakness

CWE-522 Insufficiently Protected Credentials

References

Sources

CVE List CVE-2025-54428
NVD CVE-2025-54428

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary