CVE-2026-34969: Nhost Leaks the Refresh Token via URL Query Parameter in OAuth Provider Callback

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-06 · updated 2026-10-23
Weakness: CWE-200

Description

Nhost is an open source Firebase alternative with GraphQL. Prior to 0.48.0, the auth service's OAuth provider callback flow places the refresh token directly into the redirect URL as a query parameter. Refresh tokens in URLs are logged in browser history, server access logs, HTTP Referer headers, and proxy/CDN logs. Note that the refresh token is one-time use and all of these leak vectors are on owned infrastructure or services integrated by the application developer. This vulnerability is fixed in 0.48.0.

Affected products

nhost: before 0.48.0 — fixed in 0.48.0

How to fix

Upgrade to a fixed version: nhost 0.48.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-34969 or the next vulnerability affects your stack