Read the docs
TI-2026-79297 Aliases CVE-2026-115400GHSA-qcj9-c87v-pg2g

Cleartext storage of Google OAuth tokens in crawlseo

Priority LOW 28CWE-312Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-312.

Summary

crawlseo from 0.1.0 before 0.2.5 stores Google OAuth tokens in cleartext in the User.googleTokens column. An attacker with read access to the database can take the plaintext long-lived refresh tokens and gain ongoing access to all registered users' Google Search Console data. The attacker needs high privileges on the system.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OAuth access and refresh tokens stored unencrypted in the User.googleTokens column. Attackers can read the plaintext long-lived refresh tokens from a compromised or exposed Postgres database to gain indefinite, unauthenticated access to all registered users' Google Search Console data.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00104 1st percentileScored 2026-11-07
Fix Fixed crawlseo (crawlseo): 0.2.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
crawlseocrawlseo0.1.0 to before 0.2.50.2.5Patch availableCNA
  • crawlseo Vendorcrawlseo Affected 0.1.0 to before 0.2.5 Fixed in 0.2.5 Patch available CNA

Remediation

Update crawlseo to version 0.2.5, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA crawlseo (crawlseo) Fixed in 0.2.5

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-115400
  2. 2026-10-22 Alias added: GHSA-qcj9-c87v-pg2g
  3. 2026-10-23 Priority changed: MEDIUM → LOW
  4. 2026-10-29 CISA SSVC decision points changed

References

Patch 2

Other 1

  • TI-2026-79298 crawlseo Server-Side Request Forgery via Crawler CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences