Nhost is an open source Firebase alternative with GraphQL. Prior to 0.48.0, the auth service's OAuth provider callback flow places the refresh token directly into the redirect URL as a query parameter. Refresh tokens in URLs are logged in browser history, server access logs, HTTP Referer headers, and proxy/CDN logs. Note that the refresh token is one-time use and all of these leak vectors are on owned infrastructure or services integrated by the application developer. This vulnerability is fixed in 0.48.0.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34969.json",
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-200",
"CWE-598"
]
}{
"cpe": "cpe:2.3:a:nhost:nhost\\/auth:*:*:*:*:*:*:*:*",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "0.48.0"
}
],
"source": [
"AFFECTED_FIELD",
"CPE_RANGE"
]
}