CVE-2026-34969: Nhost Leaks the Refresh Token via URL Query Parameter in OAuth Provider Callback
Vulnerability summary
CVE-2026-34969 is a high (CVSS 7.5) vulnerability in nhost. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 20.2% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 2.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 06-04-2026PublishedVulnerability first disclosed.
- 07-04-2026Last modifiedVulnerability information updated.
Description
Nhost is an open source Firebase alternative with GraphQL. Prior to 0.48.0, the auth service's OAuth provider callback flow places the refresh token directly into the redirect URL as a query parameter. Refresh tokens in URLs are logged in browser history, server access logs, HTTP Referer headers, and proxy/CDN logs. Note that the refresh token is one-time use and all of these leak vectors are on owned infrastructure or services integrated by the application developer. This vulnerability is fixed in 0.48.0.
CVSS metrics
5 scores · 3 sources · 2 versions- OSV · GoEcosystem advisory · calculated2.3LowCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
- NVDNIST2.3LowCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · GoEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.28%
Chance of exploitation in the next 30 days
Percentile
20%
Versus all other CVEs
30-day change
Decrease -0.09 pp
From 0.37% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundNhost
Maturity: poc
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-598Use of HTTP Request With Sensitive Query StringThe web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.
Affected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Nhost2 products
- nhost< 0.48.0
- nhost\/auth< 0.48.0
Github.com/nhost1 product
- nhost< 0.0.0-20260330133707-294954e0fc3a
2 vendors · 3 products
References
4 links- github.com/nhost/nhost/security/advisories/GHSA-g2qj-prgh-4g9rX Refsource CONFIRMWEBAdvisoryExploitMitigationVendor Advisory
- github.com/nhost/nhostPACKAGE