Read the docs
TI-2026-27191 Aliases CVE-2026-34969GHSA-g2qj-prgh-4g9r

Nhost Leaks the Refresh Token via URL Query Parameter in OAuth Provider Callback

Priority MEDIUM 45CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
High
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Nhost is an open source Firebase alternative with GraphQL. Prior to 0.48.0, the auth service's OAuth provider callback flow places the refresh token directly into the redirect URL as a query parameter. Refresh tokens in URLs are logged in browser history, server access logs, HTTP Referer headers, and proxy/CDN logs. Note that the refresh token is one-time use and all of these leak vectors are on owned infrastructure or services integrated by the application developer. This vulnerability is fixed in 0.48.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00277 20th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed nhost (nhost): 0.48.0github.com/nhost/nhost (Go): 0.0.0-20260330133707-294954e0fc3a

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nhostnhostbefore 0.48.00.48.0Patch availableCNA
—github.com/nhost/nhost (Go)before 0.0.0-20260330133707-294954e0fc3a0.0.0-20260330133707-294954e0fc3aPatch availableGHSA-g2qj-prgh-4g9r
  • nhost Vendornhost Affected before 0.48.0 Fixed in 0.48.0 Patch available CNA
  • github.com/nhost/nhost (Go) Vendor— Affected before 0.0.0-20260330133707-294954e0fc3a Fixed in 0.0.0-20260330133707-294954e0fc3a Patch available GHSA-g2qj-prgh-4g9r

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nhost:nhost\/auth:*:*:*:*:*:*:*:*before 0.48.0Vulnerablenhost
  • cpe:2.3:a:nhost:nhost\/auth:*:*:*:*:*:*:*:* Versions before 0.48.0 Vulnerable ·nhost

Remediation

  • Fix · CNA nhost (nhost) Fixed in 0.48.0
  • Fix · GHSA-g2qj-prgh-4g9r github.com/nhost/nhost (Go) Fixed in 0.0.0-20260330133707-294954e0fc3a Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34969
  2. 2026-10-03 Alias added: GHSA-g2qj-prgh-4g9r

References

Exploit 1

Advisory 1

Other 2

  • TI-2026-30129 Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass CVSS 4.0CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences