Dashboard / CVE-2026-34969

CVE-2026-34969

LOW
INFO Priority: 0.01 BB Relevance: 45/100
Published: 2026-04-06 Modified: 2026-10-23 First seen: 2026-10-29 Status: active

Attack Surface

Network No Auth

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: Passive
S: X
AT: Present
VC: None
VI: None
VA: None

Description

Nhost is an open source Firebase alternative with GraphQL. Prior to 0.48.0, the auth service's OAuth provider callback flow places the refresh token directly into the redirect URL as a query parameter. Refresh tokens in URLs are logged in browser history, server access logs, HTTP Referer headers, and proxy/CDN logs. Note that the refresh token is one-time use and all of these leak vectors are on owned infrastructure or services integrated by the application developer. This vulnerability is fixed in 0.48.0.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
nhost nhost\/auth < 0.48.0

References & Advisories (1)

Bug Bounty Relevance

45 / 100
✓ Network accessible
✓ No authentication

CVSS Score

2.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.27%
Raw Score 0.002670
Percentile 18.8%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00267
2026-10-28
0.00267

Intelligence Sources

nvd ref →

External Links