---
id: "CVE-2026-115400"
kind: "vulnerability"
aliases: ["CVE-2026-115400"]
title: "crawlseo: Google OAuth refresh tokens stored in plaintext in database"
severity: "medium"
cvss: 6.7
epss: 0.00087
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["crawlseo", "google-search-console", "package", "postgres", "self-hosted"]
not_affected_if: ["no-google-oauth-connected", "version-0.2.5-or-later"]
published_at: "2026-10-22T14:17:39+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T03:45:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115400", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115400", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# crawlseo: Google OAuth refresh tokens stored in plaintext in database

crawlseo stores users' Google OAuth access and refresh tokens unencrypted in the User.googleTokens database column. Anyone who can read that Postgres database can take the long-lived refresh tokens and access every registered user's Google Search Console data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed crawlseo version with `npm ls crawlseo` or the project's package.json; versions below `0.2.5` are affected.
- Look for a `googleTokens` column on the `User` table in the Postgres database (for example `\d "User"` in psql) and see whether the stored values are readable plaintext tokens.

## Fix

- Upgrade crawlseo to `0.2.5` or later.
- Revoke existing Google OAuth grants for affected users and have them reconnect, since the old refresh tokens may already be exposed.
- Restrict database read access to the crawlseo Postgres database to the application only.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115400
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115400

## From the sources

crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OAuth access and refresh tokens stored unencrypted in the User.googleTokens column. Attackers can read the plaintext long-lived refresh tokens from a compromised or exposed Postgres database to gain indefinite, unauthenticated access to all registered users' Google Search Console data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_