{"id":"CVE-2026-115400","summary":"crawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokens","details":"crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OAuth access and refresh tokens stored unencrypted in the User.googleTokens column. Attackers can read the plaintext long-lived refresh tokens from a compromised or exposed Postgres database to gain indefinite, unauthenticated access to all registered users' Google Search Console data.","modified":"2026-10-23T02:45:50.292050831Z","published":"2026-10-22T13:23:38.856Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115400.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-312"]},"references":[{"type":"ARTICLE","url":"https://gist.github.com/mansurmavlankulov/47cb8e183fec39a7afe599d1082a3399"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115400.json"},{"type":"PACKAGE","url":"https://github.com/crawlseo/crawlseo"},{"type":"REPORT","url":"https://github.com/crawlseo/crawlseo/commit/2ce0b4b2bdd6047e0a9ede037fd355381968d9bc"},{"type":"FIX","url":"https://github.com/crawlseo/crawlseo/releases/tag/v0.2.5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115400"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/crawlseo-before-cleartext-storage-of-google-oauth-tokens"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/crawlseo/crawlseo","events":[{"introduced":"f83a60ade5cf71be3806bc28e70b4638e54df20d"},{"fixed":"7d87de925cc9a8890ece8b453bda677534c22617"},{"fixed":"2ce0b4b2bdd6047e0a9ede037fd355381968d9bc"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"0.1.0"},{"fixed":"0.2.5"}]},{"source":"REFERENCES_TAG","original_tag":"v0.2.5","range":[{"fixed":"7d87de925cc9a8890ece8b453bda677534c22617"}]},{"range":[{"fixed":"2ce0b4b2bdd6047e0a9ede037fd355381968d9bc"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v0.2.4","v0.2.3","v0.2.2","v0.2.1","v0.2.0","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115400.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}