Live › vulnerability › CVE-2026-115400
Go to dashboardcrawlseo stores users' Google OAuth access and refresh tokens unencrypted in the User.googleTokens database column. Anyone who can read that Postgres database can take the long-lived refresh tokens and access every registered user's Google Search Console data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run crawlseo before with Google Search Console connected for their users. Exposure depends on who can read the Postgres database, so a database reachable by other services, backups or a compromised host raises the risk. Deployments on or later, or without Google connections, can skip it.
0.2.50.2.5No product ranges from the sources yet.
npm ls crawlseo or the project's package.json; versions below 0.2.5 are affected.googleTokens column on the User table in the Postgres database (for example \d "User" in psql) and see whether the stored values are readable plaintext tokens.0.2.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OAuth access and refresh tokens stored unencrypted in the User.googleTokens column. Attackers can read the plaintext long-lived refresh tokens from a compromised or exposed Postgres database to gain indefinite, unauthenticated access to all registered users' Google Search Console data.
This page as .md · .json · in your agent: get_signal("CVE-2026-115400")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.