CVE-2026-115400: crawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokens
crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OAuth access and refresh tokens stored unencrypted in the User.googleTokens column. Attackers can read the plaintext long-lived refresh tokens from a compromised or exposed Postgres database to gain indefinite, unauthenticated access to all registered users' Google Search Console data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
crawlseoto a version that resolves this vulnerability.Fixed in 0.2.5
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using crawlseo versions before 0.2.5 are exposed if an attacker can obtain read access to the Postgres database. The affected data is stored in the User.googleTokens column.
What does an attacker need to exploit it?
The attacker needs database read access, such as through a compromised or exposed Postgres database. No interaction by the affected users is required after the tokens have been obtained.
What can an attacker access with the stolen tokens?
An attacker can obtain Google OAuth access and refresh tokens, including long-lived refresh tokens. These tokens can provide indefinite unauthenticated access to the Google Search Console data of all registered users.
What should be done if the database may have been exposed?
Treat plaintext OAuth access and refresh tokens in User.googleTokens as potentially compromised, because database readers can retrieve them directly. Upgrade crawlseo to version 0.2.5 or later and address the database exposure.