GHSA-7hgr-xvrr-xpw3

Suggest an improvement
Source
https://github.com/advisories/GHSA-7hgr-xvrr-xpw3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-7hgr-xvrr-xpw3/GHSA-7hgr-xvrr-xpw3.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-7hgr-xvrr-xpw3
Aliases
Published
2026-05-08T17:39:48Z
Modified
2026-06-25T19:56:40Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
nhost has Session Persistence After Password Change
Details

Description

When a user changes their password, either through the authenticated password change endpoint or a password reset ticket, the ChangePassword workflow correctly hashes and persists the new password via UpdateUserChangePassword. However, it does not revoke existing sessions. The auth.refresh_tokens and auth.oauth2_refresh_tokens tables are left untouched, meaning all previously issued refresh tokens remain valid and can continue generating new access tokens indefinitely.

This vulnerability affects all password change paths (handled in change_user_password.go), since they share the same underlying workflow:

  • Authenticated password change via the Nhost dashboard or client SDK
  • Ticket-based password reset (magic links / recovery flows)
  • OAuth2/OIDC sessions managed via auth.oauth2_refresh_tokens

Attack Scenario

  1. An attacker steals a victim's refresh token via XSS or a compromised device.
  2. The victim changes their password, expecting it to terminate all active sessions.
  3. The server updates password_hash but performs no session cleanup, the stolen token remains fully functional.

Impact

The attacker retains persistent access even after the victim's password change. This is especially severe in credential theft scenarios, where the victim's only recovery action does nothing against an active session. Depending on configured TTL, the attacker's window could be days or weeks.

Database specific 
{
    "cwe_ids": [
        "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-08T17:39:48Z",
    "nvd_published_at": null,
    "severity": "LOW"
}
References

Affected packages

Go / github.com/nhost/nhost

Package

Name
github.com/nhost/nhost
View open source insights on deps.dev
Purl
pkg:golang/github.com/nhost/nhost

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.0.0-20260430132514-52c70664a7e9

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-7hgr-xvrr-xpw3/GHSA-7hgr-xvrr-xpw3.json"