{"action":"Upgrade github.com/nhost/nhost to 0.0.0-20260417112436-ec8dab3f2cf4 or later.","affected":[{"introduced":"0"}],"component":"github.com/nhost/nhost","cve_ids":["CVE-2026-41574"],"ecosystem":"Go","epss":0.00799,"exploited":false,"fixed_versions":["0.0.0-20260417112436-ec8dab3f2cf4"],"ghsa_id":"GHSA-6g38-8j4p-j3pr","id":"tcs_01M5KF03YGRMFMWGXC5B4CP4XV","modified_at":"2026-06-25T18:56:38.062931598Z","published_at":"2026-04-18T01:00:06Z","references":["https://osv.dev/vulnerability/GHSA-6g38-8j4p-j3pr","https://github.com/nhost/nhost/security/advisories/GHSA-6g38-8j4p-j3pr","https://nvd.nist.gov/vuln/detail/CVE-2026-41574","https://github.com/nhost/nhost/pull/4162","https://github.com/nhost/nhost/commit/ec8dab3f2cf46e1131ddaf893d56c37aa00380b2","https://github.com/nhost/nhost","https://github.com/nhost/nhost/releases/tag/auth%400.49.1"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-6g38-8j4p-j3pr","url":"https://osv.dev/vulnerability/GHSA-6g38-8j4p-j3pr"}],"summary":"Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass"}