The vulnerability in canto-saas-api versions before 3.0.0 arises because OAuth2Request::getQueryParams() places sensitive OAuth2 credentials (app_id, app_secret, refresh_token, and code) in the URL query string of token POST requests. This practice causes these secrets to be logged in various telemetry systems such as access logs, proxy logs, and APM traces. Additionally, when token requests fail, OAuth2::obtainAccessToken() includes the full credential-bearing request URI in exceptions, which can be recorded by application logs and error trackers. This exposure allows attackers with access to these logs or telemetry to retrieve credentials and request access tokens for the affected tenant. The vulnerability is addressed by removing sensitive data from URLs in version 3.0.0.

Exposure of sensitive OAuth2 credentials in logs and telemetry can lead to unauthorized access tokens being issued to attackers, compromising tenant security. The vulnerability does not directly affect confidentiality, integrity, or availability of the system but allows credential leakage that can be leveraged for unauthorized access. The CVSS score of 5.3 (medium) reflects the moderate risk due to the requirement of access to telemetry data and the high impact of credential compromise.

Upgrade to canto-saas-api version 3.0.0 or later, where this issue is fixed by removing sensitive credentials from URL query strings and error messages. Until the upgrade is applied, restrict access to logs, proxy logs, APM traces, and error trackers to trusted personnel only to minimize exposure. Patch status is confirmed fixed in version 3.0.0.