CVE-2026-55375

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-55375

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55375.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-55375

Aliases

GHSA-37pm-83g7-r22v

Published

2026-09-15T17:30:29Z

Modified

2026-09-17T03:47:13Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

canto-saas-api: OAuth credentials exposed in URL query string and exception messages

Details

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams() places app_id, app_secret, refresh_token, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credentials in plaintext. When a token request fails, OAuth2::obtainAccessToken() also passes the credential-bearing Guzzle request URI into AuthorizationFailedException, so application logs and error trackers can record the same secrets. An attacker with access to affected telemetry can obtain Canto credentials and use them to request access tokens for the tenant. This issue is fixed in version 3.0.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-209",
        "CWE-598"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55375.json"
}

References

Affected packages

Git / github.com/jleehr/canto-saas-api

Affected ranges

Type

GIT

Repo

https://github.com/jleehr/canto-saas-api

Events

Introduced

Fixed

300559fdae5d1bed2dc00a6477f5996833a77339

Fixed

e35b857c63f97786d949ab588d22df69a3b0720b

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.0.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.0.3

2.*

2.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55375.json"