Go/github.com/nhost/nhost CVE-2026-34969: high 7.5, EPSS 0.37%
Nhost Leaks Refresh Tokens via URL Query Parameter in OAuth Provider Callback
Action: Upgrade github.com/nhost/nhost to 0.0.0-20260330133707-294954e0fc3a or later.
go get github.com/nhost/nhost@v0.0.0-20260330133707-294954e0fc3aAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
| 0.0.0-20260330133707-294954e0fc3a |
Sources
- osv: GHSA-g2qj-prgh-4g9r
- https://github.com/nhost/nhost/security/advisories/GHSA-g2qj-prgh-4g9r
- https://nvd.nist.gov/vuln/detail/CVE-2026-34969
- https://docs.nhost.io/products/auth/pkce
- https://github.com/nhost/nhost
CVE-2026-34969 · published · modified · JSON