CWE-598
CVEs classified under CWE-598, newest first.
19 CVEsRSS
CVE-2026-113669Medium· 5.3PoCApostropheCMS: Cross-domain session token in URL confers session takeover
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A …
CVE-2026-107370Medium· 5.3When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is a…
CVE-2026-108808Low· 2.6PoCA vulnerability was determined in Eleveo Call Recording Software up to 10.3.0
A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipu…
CVE-2026-107807High· 8.8PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring…
CVE-2026-81632High· 7.2Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its o…
Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its o…
CVE-2026-55375Medium· 5.3canto-saas-api is a PHP library for interacting with the Canto SaaS API
canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams() places app_id, app_secret, refresh_token, and code in the URL query string of token POST requests, allowing …
CVE-2026-50157Medium· 6.5Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs
Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() and Authorizer::supports() paths in the Authorizer security authenticator may accept OAuth 2.0 bear…
CVE-2026-88897Medium· 5.9Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes
Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant…
CVE-2026-61614Medium· 5.9SolidInvoice is an open-source invoicing platform
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a `?token=` URL query parameter as a fallback to the `X-API-TOKEN` header. This causes long-lived API credent…
CVE-2026-76179Critical· 9.8Ebyte NA111-M Use of GET Request Method With Sensitive Query Strings
An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which…
CVE-2026-63408High· 7.5Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter o…
CVE-2026-74880Critical· 9.8openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes
openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain un…
CVE-2026-16207Low· 3.7A vulnerability was detected in django-tastypie up to 0.15.1
A vulnerability was detected in django-tastypie up to 0.15.1. Impacted is the function ApiKeyAuthentication of the file tastypie/authentication.py. The manipulation results in use of get request method with sensitive query strings. The a…
GHSA-gj2h-2fpw-fhv9Medium@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration
@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration
CVE-2026-47768Medium· 5.5nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)
nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)
CVE-2025-62317Low· 2.6HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters
HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters. Passing sensitive data in URLs may expose it through browser history, logs, or intermediary systems, potentially leading to unintended…
CVE-2026-27949Low· 2.0Plane is an an open-source project management tool
Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling (e.g., when …
CVE-2026-25118High· 7.5immich is a high performance self-hosted photo and video management solution
immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable to credential disclosure when a user authenticates to a shared album. During the authentication pr…
CVE-2025-50709Medium· 4.3An issue in Perplexity AI GPT-4 allows a remote attacker to obtain sensitive information via a GET parameter
An issue in Perplexity AI GPT-4 allows a remote attacker to obtain sensitive information via a GET parameter