crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OAuth… (CVE-2026-115400)
Description
crawlseo versions before 0.2.5 store Google OAuth access and refresh tokens in cleartext within the User.googleTokens database column. This vulnerability allows attackers who have read access to the Postgres database to obtain long-lived refresh tokens in plaintext. With these tokens, attackers can gain indefinite, unauthenticated access to all registered users' Google Search Console data. The vulnerability is classified as CWE-312 (Cleartext Storage of Sensitive Information).
CVSS v3.1
Score 4.4medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
crawlseo prior to version 0.2.5 contains a cleartext storage vulnerability where Google OAuth access and refresh tokens are stored unencrypted in the User.googleTokens column of the Postgres database. An attacker with read access to this database can extract plaintext long-lived refresh tokens, enabling indefinite unauthenticated access to all users' Google Search Console data. The CVSS 3.1 score is 4.4 (medium severity), with attack vector local, low attack complexity, high privileges required, no user interaction, and impact limited to confidentiality.
Potential Impact
Attackers with database read access can obtain unencrypted Google OAuth refresh tokens, allowing them to access all registered users' Google Search Console data indefinitely without authentication. This compromises user data confidentiality but does not affect integrity or availability.
Mitigation Recommendations
A fix is available in crawlseo version 0.2.5 and later. Users should upgrade to version 0.2.5 or newer to ensure OAuth tokens are not stored in cleartext. No vendor advisory was provided, so verify the patch status with the vendor or official sources before applying.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qcj9-c87v-pg2g
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-115400"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6ada44c04d27ba8daa6a4540
Added to database: 10/22/2026, 17:15:44 UTC
Last enriched: 10/22/2026, 17:18:07 UTC
Last updated: 10/22/2026, 23:35:27 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.