CVE-2026-55375
canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams() places app_id, app_secret, refresh_token, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credentials in plaintext. When a token request fails, OAuth2::obtainAccessToken() also passes the credential-bearing Guzzle request URI into AuthorizationFailedException, so application logs and error trackers can record the same secrets. An attacker with access to affected telemetry can obtain Canto credentials and use them to request access tokens for the tenant. This issue is fixed in version 3.0.0.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.3
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS probability
- 0.25%
- CWE
- CWE-209, CWE-598
- Published
- 2026-09-15
- Last modified
- 2026-09-15
Affected products
- jleehr canto-saas-api
Weakness type
Related vulnerabilities
- CVE-2025-68110 — ChurchCRM discloses database information on error message
- CVE-2025-62168 — Squid vulnerable to information disclosure via authentication credential leakage in error handling
- CVE-2025-47813 — loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a
- CVE-2026-33192 — free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques
- CVE-2025-71282 — XenForo Path Disclosure via open_basedir Exceptions
- CVE-2024-11625 — Information Exposure Through an Error Message vulnerability in Progress Software Corporation Sitefinity.This issue affec
- CVE-2025-36003 — IBM Security Verify Governance Identity Manager information disclosure
- CVE-2025-23320 — NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker c