Advisories · Weakness
CWE-598.
Every Advisory and CVE whose sources give the weakness CWE-598, newest first.
- CVSS 5.3 Medium
ApostropheCMS: Cross-domain session token in URL confers session takeover
- CWE-598
<4.33.0 · fixed in 4.33.0
GHSA-hhvr-8m24-qqr3 · CVE-2026-113669 - CVSS 5.3 Medium
Improper Request Handling for Active Directory Logins in auth0-lock
- auth0-lock
- Information disclosure
- CWE-598
- CVSS 2.1 Low
Eleveo Call Recording Software JWT Token logout get request method with sensitive query strings
- Eleveo Call Recording Software
- CWE-598
- CVSS 8.8 High
Nginx UI: Node Secret Credential Exposure via URL Query Parameter
- Information disclosure
- CWE-598
>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074433-a3999bd78a3b · fixed in 1.9.10-0.20260728074433-a3999bd78a3b
GHSA-pvgv-gcp7-v38g · CVE-2026-107807 - CVSS 7.2 High
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
- CWE-598
>=3.10.5, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14 · fixed in 4.15.0, 5.0.0-rc.14
GHSA-8jh5-339h-mqx9 · CVE-2026-81632 - CVSS 8.2 High
Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String
- flextype
- CWE-598
- CVSS 5.9 Medium
SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history
- SolidInvoice
- CWE-598
- CVSS 6.8 Medium
Le-yan｜Medical Practice Management System - Sensitive Data in URL
- Le-yan Medical Practice Management System
- CWE-598
- CVSS 9.3 CriticalCritical · CVSS 9+
Ebyte NA111-M Use of GET Request Method With Sensitive Query Strings
- Ebyte NA111-M Firmware
- CWE-598
- CVSS 7.5 High
Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter
- getgrav grav-plugin-api
- CWE-598
- CVSS 6.9 Medium
Mira Hormone Monitor, Mira Android App Use of GET request method with sensitive query strings
- Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Firmware
- Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Android App
- CWE-598
- CVSS 7.4 High
Session Token Exposure in URL Leading to Account Takeover in Bilin Software's HUMANIST Digital Human Resources
- Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources
- CWE-598
- CVSS 6.3 Medium
django-tastypie authentication.py ApiKeyAuthentication get request method with sensitive query strings
- django-tastypie
- CWE-598
- CVSS 7.5 High
Multiple Vulnerabilities in IBM Engineering AI hub.
- IBM Engineering AI Hub
- CWE-598
- CVSS 7.5 High
Sensitive Information Disclosure in HTTP header
- SEPPmail Secure Email Gateway & SEPPmail Cloud
- CWE-598
- CVSS 8.2 High
Grav < 1.0.0-rc.16 Authentication Bypass via token URL Parameter
- grav
- CWE-598
- CVSS 6.5 Medium
Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter
- Information disclosure
- CWE-598
>=5.0.0-BETA0, <5.9.0 · fixed in 5.9.0
GHSA-ffq7-hh2j-r24p · CVE-2026-50157 - CVSS 8.1 High
Frigate viewer can read logs exposing admin and camera credentials
- blakeblackshear frigate
- Privilege escalation
- Information disclosure
- CVSS 8.7 High
Grav API Plugin - Cross-Origin Admin Account Takeover via CORS Wildcard and JWT Query Parameter
- grav
- CWE-598
- CVSS 4.0, no score published
@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration
- Information disclosure
- CWE-598
<4.8.1 · fixed in 4.8.1
GHSA-gj2h-2fpw-fhv9 - CVSS 9.1 CriticalCritical · CVSS 9+
MLflow authentication requirement bypass can allow a user to arbitrarily create an account
- CWE-598
<2.8.0 · fixed in 2.8.0
GHSA-4qq5-mxxx-m6gg · CVE-2023-6014 - CVSS 5.3 Medium
canto-saas-api: OAuth credentials exposed in URL query string and exception messages
- Information disclosure
- CWE-598
<3.0.0 · fixed in 3.0.0
GHSA-37pm-83g7-r22v · CVE-2026-55375 - CVSS 5.5 Medium
nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)
- Information disclosure
- CWE-116
<0.3.2 · fixed in 0.3.2
GHSA-9pg3-25fq-p6cc · CVE-2026-47768 - CVSS 2.7 Low
Quay/config-tool: quay/config-tool: gitlab oauth client_secret exposed in url querystring
- Red Hat Quay 3
- CWE-598
- CVSS 6.2 Medium
Synology Storage Manager: A use of get request method with sensitive query strings vulnerability in volume…
- Synology Storage Manager
- CWE-598
- CVSS 7.7 High
Portainer: JWT accepted in URL query leaks tokens to logs and referers
- CWE-598
>=2.33.0, <2.33.8 || >=2.39.0, <2.39.2 || >=2.40.0, <2.41.0 · fixed in 2.33.8, 2.39.2, 2.41.0
GHSA-jvp4-q659-95mj · CVE-2026-44883 - CVSS 2.6 Low
HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters.
- HCL AION
- CWE-598
- CVSS 6.8 Medium
AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover
- CWE-598
<=29.0 · no fixed version yet
GHSA-5w8w-26ch-v5cw · CVE-2026-43875 - CVSS 5.3 Medium
Sensitive server_token exposed via GET parameter in V2Board thru 1.7.4.
- CWE-598
- CVSS 7.5 High
Apache OpenMeetings Uses GET Request Method With Sensitive Query Strings
- CWE-598
>=3.1.3, <9.0.0 · fixed in 9.0.0
GHSA-gcvm-c75m-h4p4 · CVE-2026-34020 - CVSS 2.0 Low
Plane Exposes User Email (PII and part of credential) in GET Parameter
- plane
- Information disclosure
- CWE-598
- CVSS 6.3 Medium
immich-server: Insecure Transmission of Authentication Credentials via Password Parameter in HTTP Request Query String When Accessing Shared Albums
- immich
- CWE-598
- CVSS 2.3 Low
Nhost Leaks Refresh Tokens via URL Query Parameter in OAuth Provider Callback
- Information disclosure
- CWE-598
<0.0.0-20260330133707-294954e0fc3a · fixed in 0.0.0-20260330133707-294954e0fc3a
GHSA-g2qj-prgh-4g9r · CVE-2026-34969 - CVSS 9.3 CriticalCritical · CVSS 9+
openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage
- CWE-598
<1.4.0 · fixed in 1.4.0
GHSA-4rh7-jwg9-m28m · CVE-2026-74880 - CVSS 3.1 Low
IBM InfoSphere Information Server is vulnerable due to disclosure of sensitive information
- IBM InfoSphere Information Server
- CWE-598
- CVSS 4.3 Medium
PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems
- CWE-598
>=0.7.8, <0.8.4 · fixed in 0.8.4
GHSA-mrqc-3276-74f8 · CVE-2026-33620 - CVSS 5.3 Medium
Gainsight Assist plugin information disclosure
- Gainsight Assist
- CWE-598
- CVSS 3.1 Low
IBM Sterling Partner Engagement Manager Information Disclosure
- IBM Sterling Partner Engagement Manager
- CWE-598
- CVSS 5.9 Medium
Multiple vulnerabilities in IBM Aspera Orchestrator
- IBM Aspera Orchestrator
- CWE-598
- CVSS 7.5 High
wwwupdate.cgi Session token in URL
- MBS UBR-01 Mk II
- MBS UBR-02
- CWE-598
- CVSS 6.9 Medium
Gogs: Access tokens get exposed through URL params in API requests
- CWE-598
<=0.13.3 · no fixed version yet
GHSA-x9p5-w45c-7ffc · CVE-2026-26196 - CVSS 5.9 Medium
Session Token Exposure via URL Query Parameters
- HCL Software ZIE for Web
- CWE-598
- CVSS 7.1 High
An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to obtain sensitive information via the sid query parameter.
- CWE-598
- CVSS 9.0 CriticalCritical · CVSS 9+
Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges via the notes field in perms.php NOTE: this is disputed by a third party who in…
- Broken access control
- Cross-site request forgery (CSRF)
- CVSS 8.1 High
Tugtainer vulnerable to Password Exposure via URL Query Parameter
- Quenary tugtainer
- CWE-598
- CVSS 5.3 Medium
Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer headers, which could allow an attacker t…
- SICK AG Incoming Goods Suite
- CWE-598
- CVSS 2.3 Low
Spectrum session token in URL
- Broadcom DX NetOps Spectrum
- CWE-598
- CVSS 6.5 Medium
IBM i Information Disclosure
- i
- CWE-598
- CVSS 5.4 Medium
HCL iAutomate is susceptible to a sensitive information disclosure
- HCL Software iAutomate
- CWE-598
- CVSS 1.0 Low
Sensitive form data in URL query parameters
- Checkmk
- CWE-598
- CVSS 5.3 Medium
Plain Text Transmission of Username and Password in the URL
- SICK AG Baggage Analytics
- SICK AG Tire Analytics
- CWE-598
- CVSS 8.2 High
An issue in DirectAdmin v1.680 allows unauthorized attackers to manipulate the page layout and replace the legitimate login interface with arbitrary attacker-controlled content via supplying a crafte…
- CWE-598
- CVSS 4.3 Medium
An issue in Perplexity AI GPT-4 allows a remote attacker to obtain sensitive information via a GET parameter
- CWE-598
- CVSS 8.8 High
An issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, the GetHttpsResponse method transmits sensitive information - including internal…
- Weak cryptography or TLS
- CWE-598
- CVSS 6.9 Medium
Sending Password in GET Request
- OpenSolution QuickCMS
- CWE-598
- CVSS 5.7 Medium
OpenText Enterprise Security Manager Information Exposure
- OpenText Enterprise Security Manager
- CWE-598
- CVSS 8.8 High
Audiobookshelf vulnerable to OIDC token exfiltration and account takeover
- advplyr audiobookshelf
- Open redirect
- CWE-523
- CVSS 4.5 Medium
File Browser allows sensitive data to be transferred in URL in github.com/filebrowser/filebrowser
- CWE-598
* · no fixed version yet
GHSA-rmwh-g367-mj4x · CVE-2025-52901 - CVSS 5.5 Medium
An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbitrary files via a crafted GET request.
- CWE-598
- CVSS 6.0 Medium
Siemens SIPROTEC 5 6MD84 (CP300): A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V11.0)…
- Siemens SIPROTEC 5 6MD84 (CP300)
- Siemens SIPROTEC 5 6MD85 (CP200)
- CWE-598