Skip to content
OpenAdvisories

Vendor

nhost

5 known vulnerabilities.

Products

nhost 4 cli 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 2.3
    CVE-2026-34969

    Nhost Leaks the Refresh Token via URL Query Parameter in OAuth Provider Callback

    Nhost is an open source Firebase alternative with GraphQL. Prior to 0.48.0, the auth service's OAuth provider callback flow places the refresh token directly into the redirect URL as a query parameter. Refresh tokens in URLs are logged in browser history, ser…

    nhost nhost github.com/nhost/nhost Go
  • Low 2.1
    CVE-2026-33221

    Nhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload

    Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.12.0, the storage service's file upload handler trusts the client-provided Content-Type header without performing server-side MIME type detection. This allows an attacker to upload …

    nhost nhost github.com/nhost/nhost Go