# CWE-598.

Every Advisory and CVE whose sources give the weakness CWE-598, newest first.

## Records, newest first

- [ApostropheCMS: Cross-domain session token in URL confers session takeover](https://agentprime.io/advisories/GHSA-hhvr-8m24-qqr3.md)
  `GHSA-hhvr-8m24-qqr3`, `CVE-2026-113669` · npm `apostrophe` and 1 more: affected `<4.33.0`, fixed in `4.33.0` · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-598
- [Improper Request Handling for Active Directory Logins in auth0-lock](https://agentprime.io/advisories/CVE-2026-107370.md)
  `CVE-2026-107370` · CVE record: Auth0 auth0-lock · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure, CWE-598
- [Eleveo Call Recording Software JWT Token logout get request method with sensitive query strings](https://agentprime.io/advisories/CVE-2026-108808.md)
  `CVE-2026-108808` · CVE record: Eleveo Call Recording Software · CVSS 2.1 Low · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-598
- [Nginx UI: Node Secret Credential Exposure via URL Query Parameter](https://agentprime.io/advisories/GHSA-pvgv-gcp7-v38g.md)
  `GHSA-pvgv-gcp7-v38g`, `CVE-2026-107807`, `GO-2026-6708` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074433-a3999bd78a3b`, fixed in `1.9.10-0.20260728074433-a3999bd78a3b` · CVSS 8.8 High · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, CWE-598
- [Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix](https://agentprime.io/advisories/GHSA-8jh5-339h-mqx9.md)
  `GHSA-8jh5-339h-mqx9`, `CVE-2026-81632`, `EEF-CVE-2026-81632` · Hex `ash_authentication` and 1 more: affected `>=3.10.5, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14`, fixed in `4.15.0`, `5.0.0-rc.14` · CVSS 7.2 High · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-598
- [Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String](https://agentprime.io/advisories/CVE-2026-88897.md)
  `CVE-2026-88897` · CVE record: flextype flextype · CVSS 8.2 High · Not analysed yet · Published 10 Sept 2026 · Tags: CWE-598
- [SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history](https://agentprime.io/advisories/CVE-2026-61614.md)
  `CVE-2026-61614` · CVE record: SolidInvoice SolidInvoice · CVSS 5.9 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: CWE-598
- [Le-yan｜Medical Practice Management System - Sensitive Data in URL](https://agentprime.io/advisories/CVE-2026-82181.md)
  `CVE-2026-82181` · CVE record: Le-yan Medical Practice Management System · CVSS 6.8 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: CWE-598
- [Ebyte NA111-M Use of GET Request Method With Sensitive Query Strings](https://agentprime.io/advisories/CVE-2026-76179.md)
  `CVE-2026-76179` · CVE record: Ebyte Ebyte NA111-M Firmware · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: CWE-598
- [Grav API Plugin: JWT Access Token Accepted via \`?token=\` URL Query Parameter](https://agentprime.io/advisories/CVE-2026-63408.md)
  `CVE-2026-63408` · CVE record: getgrav grav-plugin-api · CVSS 7.5 High · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-598
- [Mira Hormone Monitor, Mira Android App Use of GET request method with sensitive query strings](https://agentprime.io/advisories/CVE-2026-66832.md)
  `CVE-2026-66832` · CVE record: Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Firmware and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-598
- [Session Token Exposure in URL Leading to Account Takeover in Bilin Software's HUMANIST Digital Human Resources](https://agentprime.io/advisories/CVE-2026-14838.md)
  `CVE-2026-14838` · CVE record: Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources · CVSS 7.4 High · Not analysed yet · Published 4 Aug 2026 · Tags: CWE-598
- [django-tastypie authentication.py ApiKeyAuthentication get request method with sensitive query strings](https://agentprime.io/advisories/CVE-2026-16207.md)
  `CVE-2026-16207` · CVE record: django-tastypie · CVSS 6.3 Medium · Not analysed yet · Published 19 Jul 2026 · Tags: CWE-598
- [Multiple Vulnerabilities in IBM Engineering AI hub.](https://agentprime.io/advisories/CVE-2026-15322.md)
  `CVE-2026-15322` · CVE record: IBM Engineering AI Hub · CVSS 7.5 High · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-598
- [Sensitive Information Disclosure in HTTP header](https://agentprime.io/advisories/CVE-2026-9592.md)
  `CVE-2026-9592` · CVE record: SEPPmail SEPPmail Secure Email Gateway & SEPPmail Cloud · CVSS 7.5 High · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-598
- [Grav < 1.0.0-rc.16 Authentication Bypass via token URL Parameter](https://agentprime.io/advisories/CVE-2026-62386.md)
  `CVE-2026-62386` · CVE record: getgrav grav · CVSS 8.2 High · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-598
- [Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter](https://agentprime.io/advisories/GHSA-ffq7-hh2j-r24p.md)
  `GHSA-ffq7-hh2j-r24p`, `CVE-2026-50157`, `PKSA-nrzm-zxwz-yhq9` · Packagist `auth0/symfony`: affected `>=5.0.0-BETA0, <5.9.0`, fixed in `5.9.0` · CVSS 6.5 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Information disclosure, CWE-598
- [Frigate viewer can read logs exposing admin and camera credentials](https://agentprime.io/advisories/CVE-2026-54652.md)
  `CVE-2026-54652` · CVE record: blakeblackshear frigate · CVSS 8.1 High · Not analysed yet · Published 8 Jul 2026 · Tags: Privilege escalation, Information disclosure, Broken access control, CWE-598
- [Grav API Plugin - Cross-Origin Admin Account Takeover via CORS Wildcard and JWT Query Parameter](https://agentprime.io/advisories/CVE-2026-58656.md)
  `CVE-2026-58656` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 8 Jul 2026 · Tags: CWE-598
- [@nuxt/ui: UAuthForm / UForm SSR markup omits \`method\`, leaking credentials via GET if submitted before hydration](https://agentprime.io/advisories/GHSA-gj2h-2fpw-fhv9.md)
  `GHSA-gj2h-2fpw-fhv9` · npm `@nuxt/ui`: affected `<4.8.1`, fixed in `4.8.1` · CVSS 4.0, no score published · Not analysed yet · Published 2 Jul 2026 · Tags: Information disclosure, CWE-598
- [MLflow authentication requirement bypass can allow a user to arbitrarily create an account](https://agentprime.io/advisories/GHSA-4qq5-mxxx-m6gg.md)
  `GHSA-4qq5-mxxx-m6gg`, `BIT-mlflow-2023-6014`, `CVE-2023-6014`, `PYSEC-2026-415` · PyPI `mlflow`: affected `<2.8.0`, fixed in `2.8.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: CWE-598
- [canto-saas-api: OAuth credentials exposed in URL query string and exception messages](https://agentprime.io/advisories/GHSA-37pm-83g7-r22v.md)
  `GHSA-37pm-83g7-r22v`, `CVE-2026-55375`, `PKSA-cgpk-zpcz-kxmr` · Packagist `jleehr/canto-saas-api`: affected `<3.0.0`, fixed in `3.0.0` · CVSS 5.3 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Information disclosure, CWE-598
- [nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)](https://agentprime.io/advisories/GHSA-9pg3-25fq-p6cc.md)
  `GHSA-9pg3-25fq-p6cc`, `CVE-2026-47768`, `GO-2026-5294` · Go `github.com/juev/nebula-mesh`: affected `<0.3.2`, fixed in `0.3.2` · CVSS 5.5 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Information disclosure, CWE-116, CWE-598
- [Quay/config-tool: quay/config-tool: gitlab oauth client_secret exposed in url querystring](https://agentprime.io/advisories/CVE-2026-10078.md)
  `CVE-2026-10078` · CVE record: Red Hat Red Hat Quay 3 · CVSS 2.7 Low · Not analysed yet · Published 29 May 2026 · Tags: CWE-598
- [Synology Storage Manager: A use of get request method with sensitive query strings vulnerability in volume…](https://agentprime.io/advisories/CVE-2026-2237.md)
  `CVE-2026-2237` · CVE record: Synology Storage Manager · CVSS 6.2 Medium · Not analysed yet · Published 27 May 2026 · Tags: CWE-598
- [Portainer: JWT accepted in URL query leaks tokens to logs and referers](https://agentprime.io/advisories/GHSA-jvp4-q659-95mj.md)
  `GHSA-jvp4-q659-95mj`, `CVE-2026-44883`, `GO-2026-5480` · Go `github.com/portainer/portainer`: affected `>=2.33.0, <2.33.8 || >=2.39.0, <2.39.2 || >=2.40.0, <2.41.0`, fixed in `2.33.8`, `2.39.2`, `2.41.0` · CVSS 7.7 High · Not analysed yet · Published 14 May 2026 · Tags: CWE-598
- [HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters.](https://agentprime.io/advisories/CVE-2025-62317.md)
  `CVE-2025-62317` · CVE record: HCL AION · CVSS 2.6 Low · Not analysed yet · Published 14 May 2026 · Tags: CWE-598
- [AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover](https://agentprime.io/advisories/GHSA-5w8w-26ch-v5cw.md)
  `GHSA-5w8w-26ch-v5cw`, `CVE-2026-43875`, `PKSA-dbh3-mg7m-c1nc` · Packagist `wwbn/avideo`: affected `<=29.0`, no fixed version yet · CVSS 6.8 Medium · Not analysed yet · Published 5 May 2026 · Tags: CWE-598
- [Sensitive server_token exposed via GET parameter in V2Board thru 1.7.4.](https://agentprime.io/advisories/CVE-2026-37504.md)
  `CVE-2026-37504` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 1 May 2026 · Tags: CWE-598
- [Apache OpenMeetings Uses GET Request Method With Sensitive Query Strings](https://agentprime.io/advisories/GHSA-gcvm-c75m-h4p4.md)
  `GHSA-gcvm-c75m-h4p4`, `CVE-2026-34020` · Maven `org.apache.openmeetings:openmeetings-parent`: affected `>=3.1.3, <9.0.0`, fixed in `9.0.0` · CVSS 7.5 High · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-598
- [Plane Exposes User Email (PII and part of credential) in GET Parameter](https://agentprime.io/advisories/CVE-2026-27949.md)
  `CVE-2026-27949` · CVE record: makeplane plane · CVSS 2.0 Low · Not analysed yet · Published 7 Apr 2026 · Tags: Information disclosure, CWE-598
- [immich-server: Insecure Transmission of Authentication Credentials via Password Parameter in HTTP Request Query String When Accessing Shared Albums](https://agentprime.io/advisories/CVE-2026-25118.md)
  `CVE-2026-25118` · CVE record: immich-app immich · CVSS 6.3 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-598
- [Nhost Leaks Refresh Tokens via URL Query Parameter in OAuth Provider Callback](https://agentprime.io/advisories/GHSA-g2qj-prgh-4g9r.md)
  `GHSA-g2qj-prgh-4g9r`, `CVE-2026-34969`, `GO-2026-5388` · Go `github.com/nhost/nhost`: affected `<0.0.0-20260330133707-294954e0fc3a`, fixed in `0.0.0-20260330133707-294954e0fc3a` · CVSS 2.3 Low · Not analysed yet · Published 1 Apr 2026 · Tags: Information disclosure, CWE-598
- [openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage](https://agentprime.io/advisories/GHSA-4rh7-jwg9-m28m.md)
  `GHSA-4rh7-jwg9-m28m`, `CVE-2026-74880`, `PYSEC-2026-3759` · PyPI `openssl-encrypt`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Apr 2026 · Tags: CWE-598
- [IBM InfoSphere Information Server is vulnerable due to disclosure of sensitive information](https://agentprime.io/advisories/CVE-2025-14808.md)
  `CVE-2025-14808` · CVE record: IBM InfoSphere Information Server · CVSS 3.1 Low · Not analysed yet · Published 25 Mar 2026 · Tags: CWE-598
- [PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems](https://agentprime.io/advisories/GHSA-mrqc-3276-74f8.md)
  `GHSA-mrqc-3276-74f8`, `CVE-2026-33620`, `GO-2026-4822` · Go `github.com/pinchtab/pinchtab`: affected `>=0.7.8, <0.8.4`, fixed in `0.8.4` · CVSS 4.3 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-598
- [Gainsight Assist plugin information disclosure](https://agentprime.io/advisories/CVE-2026-31381.md)
  `CVE-2026-31381` · CVE record: Gainsight Gainsight Assist · CVSS 5.3 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-598
- [IBM Sterling Partner Engagement Manager Information Disclosure](https://agentprime.io/advisories/CVE-2025-14811.md)
  `CVE-2025-14811` · CVE record: IBM Sterling Partner Engagement Manager · CVSS 3.1 Low · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-598
- [Multiple vulnerabilities in IBM Aspera Orchestrator](https://agentprime.io/advisories/CVE-2025-13219.md)
  `CVE-2025-13219` · CVE record: IBM Aspera Orchestrator · CVSS 5.9 Medium · Not analysed yet · Published 10 Mar 2026 · Tags: CWE-598
- [wwwupdate.cgi Session token in URL](https://agentprime.io/advisories/CVE-2025-41772.md)
  `CVE-2025-41772` · CVE record: MBS UBR-01 Mk II and 2 more · CVSS 7.5 High · Not analysed yet · Published 9 Mar 2026 · Tags: CWE-598
- [Gogs: Access tokens get exposed through URL params in API requests](https://agentprime.io/advisories/GHSA-x9p5-w45c-7ffc.md)
  `GHSA-x9p5-w45c-7ffc`, `CVE-2026-26196`, `GO-2026-4619` · Go `gogs.io/gogs`: affected `<=0.13.3`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-598
- [Session Token Exposure via URL Query Parameters](https://agentprime.io/advisories/CVE-2025-59873.md)
  `CVE-2025-59873` · CVE record: HCL Software ZIE for Web · CVSS 5.9 Medium · Not analysed yet · Published 23 Feb 2026 · Tags: CWE-598
- [An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to obtain sensitive information via the sid query parameter.](https://agentprime.io/advisories/CVE-2026-26721.md)
  `CVE-2026-26721` · CVE record · CVSS 7.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: CWE-598
- [Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges via the notes field in perms.php NOTE: this is disputed by a third party who in…](https://agentprime.io/advisories/CVE-2025-69634.md)
  `CVE-2025-69634` · CVE record · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Feb 2026 · Tags: Broken access control, Cross-site request forgery (CSRF), CWE-598
- [Tugtainer vulnerable to Password Exposure via URL Query Parameter](https://agentprime.io/advisories/CVE-2026-23846.md)
  `CVE-2026-23846` · CVE record: Quenary tugtainer · CVSS 8.1 High · Not analysed yet · Published 19 Jan 2026 · Tags: CWE-598
- [Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer headers, which could allow an attacker t…](https://agentprime.io/advisories/CVE-2026-22644.md)
  `CVE-2026-22644` · CVE record: SICK AG Incoming Goods Suite · CVSS 5.3 Medium · Not analysed yet · Published 15 Jan 2026 · Tags: CWE-598
- [Spectrum session token in URL](https://agentprime.io/advisories/CVE-2025-69270.md)
  `CVE-2025-69270` · CVE record: Broadcom DX NetOps Spectrum · CVSS 2.3 Low · Not analysed yet · Published 12 Jan 2026 · Tags: CWE-598
- [IBM i Information Disclosure](https://agentprime.io/advisories/CVE-2025-36371.md)
  `CVE-2025-36371` · CVE record: IBM i · CVSS 6.5 Medium · Not analysed yet · Published 19 Nov 2025 · Tags: CWE-598
- [HCL iAutomate is susceptible to a sensitive information disclosure](https://agentprime.io/advisories/CVE-2025-31954.md)
  `CVE-2025-31954` · CVE record: HCL Software iAutomate · CVSS 5.4 Medium · Not analysed yet · Published 5 Nov 2025 · Tags: CWE-598
- [Sensitive form data in URL query parameters](https://agentprime.io/advisories/CVE-2025-32916.md)
  `CVE-2025-32916` · CVE record: Checkmk GmbH Checkmk · CVSS 1.0 Low · Not analysed yet · Published 9 Oct 2025 · Tags: CWE-598
- [Plain Text Transmission of Username and Password in the URL](https://agentprime.io/advisories/CVE-2025-58584.md)
  `CVE-2025-58584` · CVE record: SICK AG Baggage Analytics and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2025 · Tags: CWE-598
- [An issue in DirectAdmin v1.680 allows unauthorized attackers to manipulate the page layout and replace the legitimate login interface with arbitrary attacker-controlled content via supplying a crafte…](https://agentprime.io/advisories/CVE-2025-56551.md)
  `CVE-2025-56551` · CVE record · CVSS 8.2 High · Not analysed yet · Published 3 Oct 2025 · Tags: CWE-598
- [An issue in Perplexity AI GPT-4 allows a remote attacker to obtain sensitive information via a GET parameter](https://agentprime.io/advisories/CVE-2025-50709.md)
  `CVE-2025-50709` · CVE record · CVSS 4.3 Medium · Not analysed yet · Published 17 Sept 2025 · Tags: CWE-598
- [An issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, the GetHttpsResponse method transmits sensitive information - including internal…](https://agentprime.io/advisories/CVE-2025-50110.md)
  `CVE-2025-50110` · CVE record · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2025 · Tags: Weak cryptography or TLS, CWE-598
- [Sending Password in GET Request](https://agentprime.io/advisories/CVE-2025-54542.md)
  `CVE-2025-54542` · CVE record: OpenSolution QuickCMS · CVSS 6.9 Medium · Not analysed yet · Published 28 Aug 2025 · Tags: CWE-598
- [OpenText Enterprise Security Manager Information Exposure](https://agentprime.io/advisories/CVE-2025-8997.md)
  `CVE-2025-8997` · CVE record: OpenText OpenText Enterprise Security Manager · CVSS 5.7 Medium · Not analysed yet · Published 25 Aug 2025 · Tags: CWE-598
- [Audiobookshelf vulnerable to OIDC token exfiltration and account takeover](https://agentprime.io/advisories/CVE-2025-57800.md)
  `CVE-2025-57800` · CVE record: advplyr audiobookshelf · CVSS 8.8 High · Not analysed yet · Published 22 Aug 2025 · Tags: Open redirect, CWE-523, CWE-598
- [File Browser allows sensitive data to be transferred in URL in github.com/filebrowser/filebrowser](https://agentprime.io/advisories/GHSA-rmwh-g367-mj4x.md)
  `GHSA-rmwh-g367-mj4x`, `CVE-2025-52901`, `GO-2025-3794` · Go `github.com/filebrowser/filebrowser` and 1 more: affected `*`, no fixed version yet · CVSS 4.5 Medium · Not analysed yet · Published 28 Jul 2025 · Tags: CWE-598
- [An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbitrary files via a crafted GET request.](https://agentprime.io/advisories/CVE-2025-51651.md)
  `CVE-2025-51651` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 14 Jul 2025 · Tags: CWE-598
- [Siemens SIPROTEC 5 6MD84 (CP300): A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V11.0)…](https://agentprime.io/advisories/CVE-2025-40742.md)
  `CVE-2025-40742` · CVE record: Siemens SIPROTEC 5 6MD84 (CP300) and 4 more · CVSS 6.0 Medium · Not analysed yet · Published 8 Jul 2025 · Tags: CWE-598

Older: <https://agentprime.io/advisories/tag/cwe-598.md?cursor=WyIyMDI1LTA3LTA4VDEwOjM1OjAyLjA5NTAwMFoiLCJDVkUtMjAyNS00MDc0MiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-598>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-598/>. Everything for agents: <https://agentprime.io/llms.txt>.