CVE-2026-55375 Details

A vulnerability in the Canto SaaS API PHP library, prior to version 3.0.0, allows OAuth credentials to be exposed in plaintext through URL query strings and exception messages. The issue arises because the library's OAuth2Request class includes sensitive information such as app_id, app_secret, refresh_token, and authorization code in the query string of token POST requests. This information can be captured by access logs, proxy logs, and application performance monitoring (APM) traces. Additionally, when a token request fails, the OAuth2 class passes the request URI, which contains the credentials, into an exception that can be logged by the application. As a result, an attacker with access to these logs can obtain Canto credentials and use them to request access tokens for the tenant.

Users can upgrade to Canto SaaS API version 3.0.0 or later, where this vulnerability has been fixed. In version 3.0.0, OAuth credentials are sent in the form-encoded POST body instead of the URL query string, and exception messages no longer expose sensitive information. If an upgrade is not possible, Canto OAuth credentials should be treated as secret material and access to logs containing exposed credentials should be restricted.