Executive brief
Whoogle Search is a privacy-focused search engine that acts as a proxy for Google results. A security flaw in version 1.2.3 allows any visitor to view the server's private Google API keys and search engine identifiers. An attacker could steal these credentials to use the owner's paid search quota or perform unauthorized searches using the owner's identity.
Technical details
An information disclosure vulnerability exists in the /config endpoint of Whoogle Search v1.2.3. The application fails to filter sensitive fields when returning the user configuration dictionary (g.user_config.__dict__) via a GET request. Specifically, the 'cse_api_key' and 'cse_id' fields are exposed to unauthenticated remote users. Additionally, these credentials may be rendered into client-visible state within index and header templates or encoded within preference values used by the root and search routes. Even if WHOOGLE_CONFIG_DISABLE is enabled, the fields remain visible in the GET response, allowing attackers to exfiltrate server-side API credentials.
Affected products
- Ben Busby whoogle-search 1.2.3
Timeline
- 2026-06-13: other: Vulnerability details shared via GitHub Gist
- 2026-06-15: disclosed: CVE published to NVD