Nhost provides authentication and command-line infrastructure products that have surfaced a small number of vulnerabilities concentrated in authentication and information-disclosure classes, including improper authentication, exposure of sensitive information, and missing authentication for critical functions. These findings reflect the security-sensitive role of authentication systems and the data-handling demands of identity and access control; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Nhost over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-41574CRITICAL Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.49.1, Nhost automatically links an incoming OAuth identity to an existing Nhost account when the email | May 8, 2026 | 9.8 | 34 | NO | NO |
CVE-2026-34969HIGH Nhost is an open source Firebase alternative with GraphQL. Prior to 0.48.0, the auth service's OAuth provider callback flow places the refresh token directly into the redirect URL | Apr 6, 2026 | 7.5 | 29 | NO | NO |
CVE-2026-34200HIGH Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a network port, applies no inb | Mar 31, 2026 | 7.5 | 25 | NO | NO |
CVE-2026-33221MEDIUM Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.12.0, the storage service's file upload handler trusts the client-provided Content-Type header without | Mar 20, 2026 | 5.3 | 19 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Nhost.
Media articles that mention a CVE ID that affects a product developed by Nhost — matched by CVE ID, not by vendor name.