Description
Nhost is an open source Firebase alternative with GraphQL. Prior to 0.48.0, the auth service's OAuth provider callback flow places the refresh token directly into the redirect URL as a query parameter. Refresh tokens in URLs are logged in browser history, server access logs, HTTP Referer headers, and proxy/CDN logs. Note that the refresh token is one-time use and all of these leak vectors are on owned infrastructure or services integrated by the application developer. This vulnerability is fixed in 0.48.0.
Problem types
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-598: Use of GET Request Method With Sensitive Query Strings
Product status
References
github.com/.../nhost/security/advisories/GHSA-g2qj-prgh-4g9r
github.com/.../nhost/security/advisories/GHSA-g2qj-prgh-4g9r