# CVE-2026-34969: Nhost Leaks Refresh Tokens via URL Query Parameter in OAuth Provider Callback

Source: https://junglewise.ai/threats/cve-2026-34969-nhost-leaks-refresh-tokens-via-url-query-parameter-in-oauth  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-06. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-34969 · Severity: high · CVSS 7.5 · Published 2026-04-06

Nhost is an open source Firebase alternative with GraphQL. Prior to 0.48.0, the auth service's OAuth provider callback flow places the refresh token directly into the redirect URL as a query parameter. Refresh tokens in URLs are logged in browser history, server access logs, HTTP Referer headers, and proxy/CDN logs. Note that the refresh token is one-time use and all of these leak vectors are on owned infrastructure or services integrated by the application developer. This vulnerability is fixed in 0.48.0.

Technologies: [github.com/nhost/nhost (Go)](https://junglewise.ai/threats/technologies/github-com-nhost-nhost), [Nhost\](https://junglewise.ai/threats/technologies/nhost). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Nhost](https://junglewise.ai/threats/vendors/nhost).

## Quick answers

**Is CVE-2026-34969 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34969 being exploited in the wild.

**How severe is CVE-2026-34969?** High severity, with a CVSS score of 7.5, published 6 April 2026.

**Which products and versions are affected?** github.com/nhost/nhost (Go) < 0.0.0-20260330133707-294954e0fc3a, SEMVER:introduced=0,fixed=0.0.0-20260330133707-294954e0fc3a.

**Is there a fix for CVE-2026-34969?** Yes. github.com/nhost/nhost (Go): upgrade to 0.0.0-20260330133707-294954e0fc3a or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-34969?** Check whether you run github.com/nhost/nhost (Go), Nhost Auth or Nhost\ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/nhost/nhost (Go): upgrade to 0.0.0-20260330133707-294954e0fc3a or later

  ```sh
  go get github.com/nhost/nhost@v0.0.0-20260330133707-294954e0fc3a
  ```


## Affected products

- github.com/nhost/nhost (Go) < 0.0.0-20260330133707-294954e0fc3a, SEMVER:introduced=0,fixed=0.0.0-20260330133707-294954e0fc3a
- Nhost Auth
- Nhost\

## Identifiers

- CVE-2026-34969
- GHSA-g2qj-prgh-4g9r
- GO-2026-5388

## References

- [https://api.github.com/users/0xkakash1](https://api.github.com/users/0xkakash1)
- [https://github.com/0xkakash1](https://github.com/0xkakash1)
- [https://api.github.com/users/0xkakash1/gists%7B/gist_id%7D](https://api.github.com/users/0xkakash1/gists%7B/gist_id%7D)
- [https://api.github.com/users/0xkakash1/repos](https://api.github.com/users/0xkakash1/repos)
- [https://avatars.githubusercontent.com/u/63727500?v=4](https://avatars.githubusercontent.com/u/63727500?v=4)
- [https://api.github.com/users/0xkakash1/events%7B/privacy%7D](https://api.github.com/users/0xkakash1/events%7B/privacy%7D)

## Related threats

- [Nhost CLI missing authentication in local configserver](https://junglewise.ai/threats/cve-2026-47671-nhost-cli-missing-authentication-in-local-configserver)
- [GO-2026-5222 - nhost has Session Persistence After Password Change in github.com/nhost/nhost](https://junglewise.ai/threats/go-2026-5222-nhost-has-session-persistence-after-password-change-in-e6267a6c)
- [nhost has Session Persistence After Password Change](https://junglewise.ai/threats/nhost-has-session-persistence-after-password-change-5e441ae8)
- [Nhost Auth account takeover via OAuth email verification bypass](https://junglewise.ai/threats/cve-2026-41574-nhost-vulnerable-to-account-takeover-via-oauth-email-verification)
- [Nhost Storage Service MIME type spoofing in file upload handler](https://junglewise.ai/threats/cve-2026-33221-nhost-storage-service-mime-type-spoofing-in-file-upload-handler)