CVE-2026-55375
Received Received - Intake

OAuth2 Credential Exposure in Canto SaaS API Library

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams() places app_id, app_secret, refresh_token, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credentials in plaintext. When a token request fails, OAuth2::obtainAccessToken() also passes the credential-bearing Guzzle request URI into AuthorizationFailedException, so application logs and error trackers can record the same secrets. An attacker with access to affected telemetry can obtain Canto credentials and use them to request access tokens for the tenant. This issue is fixed in version 3.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-55375
EUVD
EUVD-2026-78902

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
jleehr canto-saas-api to 3.0.0 (exc)
jleehr canto-saas-api 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.
CWE-598 The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in canto-saas-api before version 3.0.0 involves OAuth2 credentials being exposed in URLs and logs. The OAuth2Request::getQueryParams() function includes sensitive data like app_id, app_secret, refresh_token, and code in the query string of token POST requests. This means credentials appear in plaintext in access logs, proxy logs, and APM traces. Additionally, OAuth2::obtainAccessToken() passes the full request URI containing these credentials into AuthorizationFailedException, risking exposure in application logs and error trackers.

Detection Guidance

Check application and proxy logs for OAuth2 token requests containing sensitive credentials in URLs. Look for GET or POST requests to token endpoints with app_id, app_secret, refresh_token, or code parameters exposed in query strings.

Impact Analysis

If you use canto-saas-api before version 3.0.0, attackers with access to your system logs, telemetry, or error trackers could extract OAuth2 credentials. These credentials could then be used to request access tokens for your Canto tenant, potentially allowing unauthorized access to your data or services.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. Exposure of OAuth2 credentials could enable attackers to access such data, violating these regulations and potentially resulting in legal penalties or data breaches.

Mitigation Strategies

Upgrade canto-saas-api to version 3.0.0 or later. Review and redact any logs containing exposed credentials. Ensure OAuth2 token requests no longer include secrets in URLs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55375. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart