CVE-2025-52493

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-10 · updated 2026-06-17
Weakness: CWE-200

Description

PagerDuty Runbook through 2025-06-12 exposes stored secrets directly in the webpage DOM at the configuration page. Although these secrets appear masked as password fields, the actual secret values are present in the page source and can be revealed by simply modifying the input field type from "password" to "text" using browser developer tools. This vulnerability is exploitable by administrative users who have access to the configuration page.

Affected products

Pagerduty Runbook Automation: through 2025-06-12

References

https://github.com/carterross2/Vulnerability-Research/tree/main/CVE-2025-52493
https://www.pagerduty.com/platform/automation/
https://www.pagerduty.com/security/disclosure/
https://www.praetorian.com

Get alerted when CVE-2025-52493 or the next vulnerability affects your stack