CVE-2026-115400
crawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokens
crawlseo crawlseo
CVSS
6.7MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.09%Chance of exploitation activity in the next 30 days, higher than 0% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.2.5crawlseoCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OAuth access and refresh tokens stored unencrypted in the User.googleTokens column. Attackers can read the plaintext long-lived refresh tokens from a compromised or exposed Postgres database to gain indefinite, unauthenticated access to all registered users' Google Search Console data.
Text from CVE List
Affected versions 1
- crawlseoaffected: 0.1.0 before 0.2.5CVE List
References 4
- github.com/crawlseo/crawlseo/releases/tag/v0.2.5Fixvia CVE List
- github.com/crawlseo/crawlseo/commit/2ce0b4b2bdd6047e0a9ede037fd355381968d9bcFixvia CVE List
- vulncheck.com/advisories/crawlseo-before-cleartext-storage-of-google-oauth-tokensAdvisoryvia CVE List
- gist.github.com/mansurmavlankulov/47cb8e183fec39a7afe599d1082a3399Referencevia CVE List