Nhost is an open source Firebase alternative with GraphQL. Prior to 0.48.0, the auth service's OAuth provider callback flow places the refresh token directly into the redirect URL as a query parameter. Refresh tokens in URLs are logged in browser history, server access logs, HTTP Referer headers, and proxy/CDN logs. Note that the refresh token is one-time use and all of these leak vectors are on owned infrastructure or services integrated by the application developer. This vulnerability is fixed in 0.48.0.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-g2qj-prgh-4g9r | Nhost Leaks Refresh Tokens via URL Query Parameter in OAuth Provider Callback |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Mon, 06 Apr 2026 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Nhost is an open source Firebase alternative with GraphQL. Prior to 0.48.0, the auth service's OAuth provider callback flow places the refresh token directly into the redirect URL as a query parameter. Refresh tokens in URLs are logged in browser history, server access logs, HTTP Referer headers, and proxy/CDN logs. Note that the refresh token is one-time use and all of these leak vectors are on owned infrastructure or services integrated by the application developer. This vulnerability is fixed in 0.48.0. | |
| Title | Nhost Leaks the Refresh Token via URL Query Parameter in OAuth Provider Callback | |
| Weaknesses | CWE-200 CWE-598 |
|
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-04-06T16:01:10.174Z
Reserved: 2026-03-31T19:38:31.616Z
Link: CVE-2026-34969
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-04-06T16:16:38.457
Modified: 2026-04-06T16:16:38.457
Link: CVE-2026-34969
Redhat
No data.
OpenCVE Enrichment
No data.