CVE-2026-115400 — crawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokens
crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OAuth access and refresh tokens stored …
Published: 2026-10-22 · CVSS: 6.7 · CVSS 4.0
crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OAuth access and refresh tokens stored unencrypted in the User.googleTokens column. Attackers can read the plaintext long-lived refresh tokens from a compromised or exposed Postgres database to gain indefinite, unauthenticated access to all registered users' Google Search Console data.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7