CVE-2026-34969

Nhost, an open-source Firebase alternative featuring GraphQL capabilities, contains a critical authentication vulnerability affecting versions prior to 0.48.0. The OAuth provider callback flow exposes refresh tokens directly in redirect URL query parameters, creating multiple exposure vectors through browser history, server access logs, HTTP Referer headers, and proxy/CDN logs. Although refresh tokens are single-use, the exposure creates significant confidentiality risks across infrastructure and integrated services under developer control. The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network-based attack vector requiring no privileges or user interaction, indicating broad exploitability. The attack has low complexity and results in high confidentiality impact with no integrity or availability concerns. The FAUCET Risk Score of 48.0/100 reflects elevated risk within the vulnerability landscape. The vulnerability shows no evidence of active exploitation and does not appear on the KEV catalog, suggesting limited real-world weaponization at present. However, its presence on the Active Hot List indicates ongoing community attention and monitoring. A patch is available in version 0.48.0, and organizations running vulnerable versions should prioritize upgrading immediately given the straightforward nature of token exposure through standard logging mechanisms.