CWE-598

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.0.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "jleehr/canto-saas-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55375"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209",
      "CWE-598"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T14:16:41Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n  In affected versions, the OAuth2 token request sends `app_id`, `app_secret`,\n  `refresh_token` and `code` as URL query parameters of the POST request to\n  `https://oauth.\u003cdomain\u003e/oauth/api/oauth2/token`. Request URLs are commonly\n  recorded in access logs, proxy logs and APM traces, so the application secret\n  and refresh token can be persisted in plain text outside the application\u0027s\n  control.\n\n  In addition, when the token request fails, the Guzzle exception message \u2014\n  which contains the full request URI including the credentials \u2014 was passed\n  unmodified into the `AuthorizationFailedException` thrown by\n  `OAuth2::obtainAccessToken()`. Applications that log exceptions or forward\n  them to error trackers (e.g. Sentry) may therefore have recorded the app\n  secret in their logs.\n\n  ## Impact\n\n  An attacker with access to web server logs, proxy logs, APM tracing data or\n  application error logs of a consumer of this library can obtain the Canto\n  `app_secret`, `refresh_token` or authorization `code` and use them to obtain\n  access tokens for the Canto tenant.\n\n  ## Patches\n\n  Fixed in 3.0.0:\n\n  - OAuth credentials are sent in the form-encoded POST body instead of the URL\n    query string (RFC 6749 \u00a72.3.1). `OAuth2Request::getQueryParams()` now\n    returns `null`; the parameters are available via `getFormParams()`.\n  - Exception messages are sanitized before being rethrown: the values of\n    `app_secret`, `refresh_token` and `code` are masked (including url-encoded,\n    differently cased and JSON-embedded variants).\n\n  ## Workarounds\n\n  If you cannot upgrade:\n\n  - Treat web server, proxy and APM logs of systems performing Canto OAuth\n    requests as secret material and restrict access to them.\n  - Catch `AuthorizationFailedException` in your application and strip the query\n    string from the message before logging or forwarding it.\n\n  If your logs may have been exposed, rotate the affected Canto app secret.",
  "id": "GHSA-37pm-83g7-r22v",
  "modified": "2026-06-19T14:16:41Z",
  "published": "2026-06-19T14:16:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jleehr/canto-saas-api/security/advisories/GHSA-37pm-83g7-r22v"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jleehr/canto-saas-api"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "canto-saas-api: OAuth credentials exposed in URL query string and exception messages"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-37935"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-598"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-10T17:15:12Z",
    "severity": "HIGH"
  },
  "details": "A use of GET request method with sensitive query strings vulnerability in Fortinet FortiOS 7.0.0 - 7.0.12, 7.2.0 - 7.2.5 and 7.4.0 allows an attacker to view plaintext passwords of remote services such as RDP or VNC, if the attacker is able to read the GET requests to those services.",
  "id": "GHSA-3gmg-v9xp-m3jg",
  "modified": "2024-04-04T08:30:14Z",
  "published": "2023-10-10T18:31:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37935"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.com/psirt/FG-IR-23-120"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-26721"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-598"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-20T17:25:55Z",
    "severity": "HIGH"
  },
  "details": "An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to obtain sensitive information via the sid query parameter.",
  "id": "GHSA-42h9-mr3g-6gc2",
  "modified": "2026-02-23T21:31:23Z",
  "published": "2026-02-20T18:31:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26721"
    },
    {
      "type": "WEB",
      "url": "https://github.com/chndlrx/vulnerability-disclosures/tree/main/CVE-2026-26721"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-23766"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-598"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-26T21:15:12Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices. The gateway exposes a web interface on port 80. An unauthenticated GET request to a specific URL triggers the reboot of the Anybus gateway (or at least most of its modules). An attacker can use this feature to carry out a denial of service attack by continuously sending GET requests to that URL.",
  "id": "GHSA-4cqv-cv9m-26q8",
  "modified": "2024-07-03T18:47:04Z",
  "published": "2024-06-26T21:32:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23766"
    },
    {
      "type": "WEB",
      "url": "https://sensepost.com/blog/2024/targeting-an-industrial-protocol-gateway"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-13219"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-598"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-10T20:16:19Z",
    "severity": "MODERATE"
  },
  "details": "IBM Aspera Orchestrator 3.0.0 through 4.1.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history.",
  "id": "GHSA-4hf4-8437-8wg9",
  "modified": "2026-03-10T21:32:17Z",
  "published": "2026-03-10T21:32:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13219"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7263083"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mlflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.8.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-6014"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-598"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-11-17T22:49:27Z",
    "nvd_published_at": "2023-11-16T21:15:09Z",
    "severity": "CRITICAL"
  },
  "details": "An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirement.",
  "id": "GHSA-4qq5-mxxx-m6gg",
  "modified": "2024-03-01T21:26:17Z",
  "published": "2023-11-16T21:30:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6014"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mlflow/mlflow/issues/9669"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mlflow/mlflow/pull/9700"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mlflow/mlflow/commit/32de2154ef9f946160e5dc01a4d8a449dd0bd259"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mlflow/mlflow"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mlflow/mlflow/releases/tag/v2.8.0"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/3e64df69-ddc2-463e-9809-d07c24dc1de4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MLflow authentication requirement bypass can allow a user to arbitrarily create an account"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "openssl-encrypt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-598"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-01T21:12:19Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nRefresh tokens are accepted as URL query parameters in the keyserver and telemetry server routes.\n\n### Affected Code\n\n```python\n# openssl_encrypt_server/modules/keyserver/routes.py:214-215\n# openssl_encrypt_server/modules/telemetry/routes.py:90-91\nasync def refresh_token(\n    request: Request,\n    refresh_token: str = Query(..., description=\"Refresh token\")\n):\n```\n\n### Impact\n\nTokens in URL query parameters are exposed in:\n- Server access logs\n- Proxy/CDN logs\n- Browser history\n- HTTP Referer headers\n- Network monitoring tools\n\nThis creates significant token leakage risk.\n\n### Recommended Fix\n\n- Accept refresh tokens in the request body (POST) instead of query parameters\n- Use `Body(...)` instead of `Query(...)`\n\n### Fix\n\nFixed in commit `4b2adb0` on branch `releases/1.4.x` \u2014 moved refresh token from Query parameter to POST body via RefreshRequest Pydantic model.",
  "id": "GHSA-4rh7-jwg9-m28m",
  "modified": "2026-04-01T21:12:19Z",
  "published": "2026-04-01T21:12:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-4rh7-jwg9-m28m"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jahlives/openssl_encrypt/commit/4b2adb05cde8a7ee03cdd271755da3b377c68011"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jahlives/openssl_encrypt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-15322"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-598"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-17T20:17:15Z",
    "severity": "HIGH"
  },
  "details": "IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive information due to the exposure of session tokens in URLs.",
  "id": "GHSA-566p-xg3p-vvgr",
  "modified": "2026-07-17T21:31:43Z",
  "published": "2026-07-17T21:31:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15322"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7279964"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-26058"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-598"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-18T18:15:35Z",
    "severity": "MODERATE"
  },
  "details": "Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access the admin panel or other protected areas, the application appends sensitive authentication tokens directly to the URL.",
  "id": "GHSA-569q-p62w-x28h",
  "modified": "2025-02-19T21:31:37Z",
  "published": "2025-02-18T18:33:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26058"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mano257200/QloApps-VUL"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-2237"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-598"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-27T09:16:27Z",
    "severity": "MODERATE"
  },
  "details": "A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local attackers to obtain sensitive information.",
  "id": "GHSA-5v68-527q-prqv",
  "modified": "2026-05-27T09:31:16Z",
  "published": "2026-05-27T09:31:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2237"
    },
    {
      "type": "WEB",
      "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_26_01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}