Skip to content
OpenAdvisories

Package · Go

github.com/nhost/nhost

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low —
    GHSA-7hgr-xvrr-xpw3

    nhost has Session Persistence After Password Change

    ## Description When a user changes their password, either through the authenticated password change endpoint or a password reset ticket, the [`ChangePassword`](https://github.com/nhost/nhost/blob/main/services/auth/go/controller/workflows.go#L731-L759) workfl…

    github.com/nhost/nhost Go
  • Low 2.3
    CVE-2026-34969

    Nhost Leaks the Refresh Token via URL Query Parameter in OAuth Provider Callback

    Nhost is an open source Firebase alternative with GraphQL. Prior to 0.48.0, the auth service's OAuth provider callback flow places the refresh token directly into the redirect URL as a query parameter. Refresh tokens in URLs are logged in browser history, ser…

    nhost nhost github.com/nhost/nhost Go
  • Low 2.1
    CVE-2026-33221

    Nhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload

    Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.12.0, the storage service's file upload handler trusts the client-provided Content-Type header without performing server-side MIME type detection. This allows an attacker to upload …

    nhost nhost github.com/nhost/nhost Go