CVE-2026-34969 Details
Description
Nhost is an open source Firebase alternative with GraphQL. Prior to 0.48.0, the auth service's OAuth provider callback flow places the refresh token directly into the redirect URL as a query parameter. Refresh tokens in URLs are logged in browser history, server access logs, HTTP Referer headers, and proxy/CDN logs. Note that the refresh token is one-time use and all of these leak vectors are on owned infrastructure or services integrated by the application developer. This vulnerability is fixed in 0.48.0.
A vulnerability in the Nhost auth service's OAuth provider callback flow prior to version 0.48.0 allows refresh tokens to be leaked via the redirect URL as a query parameter. This exposure occurs because URLs are logged in browser history, server access logs, HTTP Referer headers, and proxy/CDN logs. The refresh token, which is one-time use, can be intercepted and used to generate new access tokens, leading to session hijacking.
Users can update to Nhost version 0.48.0 or later, where this vulnerability has been fixed. Instructions for updating can be found in the Nhost documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nhost/nhost/security/advisories/GHSA-g2qj-prgh-4g9r | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/nhost/nhost/security/advisories/GHSA-g2qj-prgh-4g9r | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-598 | Use of GET Request Method With Sensitive Query Strings | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nhost nhost/auth | < 0.48.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | Initial Analysis | [email protected] |
| Apr 7, 2026 | CVE Modified | CISA-ADP |
| Apr 6, 2026 | New CVE Received | [email protected] |