Nhost vulnerabilities
We track 3 vulnerabilities in Nhost products across 3 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on May 8, 2026.
Latest Nhost vulnerabilities
- 9.8 Critical severity
nhost: Improper Authentication
Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.49.1, Nhost automatically links an incoming OAuth identity to an existing Nhost account when the email addresses match. This is only safe when the email has been verified by the OAut
- 7.5 High severity
nhost: Exposure of Sensitive Information to an Unauthorized Actor
Nhost is an open source Firebase alternative with GraphQL. Prior to 0.48.0, the auth service's OAuth provider callback flow places the refresh token directly into the redirect URL as a query parameter. Refresh tokens in URLs are logged in browser history, serv
- 7.5 High severity
nhost: Missing Authentication for Critical Functionality
Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a network port, applies no inbound authentication and does not enforce strict CORS. This allows a malicious we