Nhost/auth vulnerabilities

2 known vulnerabilities in Nhost/auth from Nhost. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  nhost: Improper Authentication

  CVE-2026-41574May 8, 2026Nhost

  Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.49.1, Nhost automatically links an incoming OAuth identity to an existing Nhost account when the email addresses match. This is only safe when the email has been verified by the OAut

• 7.5 High severity

  nhost: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-34969Apr 6, 2026Nhost

  Nhost is an open source Firebase alternative with GraphQL. Prior to 0.48.0, the auth service's OAuth provider callback flow places the refresh token directly into the redirect URL as a query parameter. Refresh tokens in URLs are logged in browser history, serv