CVE-2026-41574
critical
CVSS v3
9.8
CVSS v2
—
VIR risk
9.8
Description
Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass
Predictions
Exploit likelihood
97%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: security-advisories@github.com — https://github.com/nhost/nhost/security/advisories/GHSA-6g38-8j4p-j3pr
Vendor advisory: security-advisories@github.com — https://github.com/nhost/nhost/releases/tag/auth%400.49.1
Vendor advisory: security-advisories@github.com — https://github.com/nhost/nhost/pull/4162
Vendor advisory: security-advisories@github.com — https://github.com/nhost/nhost/commit/ec8dab3f2cf46e1131ddaf893d56c37aa00380b2
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Go | github.com/nhost/nhost | <0.0.0-20260417112436-ec8dab3f2cf4 | 0.0.0-20260417112436-ec8dab3f2cf4 |
| GO | github.com/nhost/nhost | < 0.0.0-20260417112436-ec8dab3f2cf4 | 0.0.0-20260417112436-ec8dab3f2cf4 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| nhost | nhost\/auth | {"endExcluding":"0.49.1"} | 0.49.1 |
References
- https://github.com/nhost/nhost/commit/ec8dab3f2cf46e1131ddaf893d56c37aa00380b2
- https://github.com/nhost/nhost/pull/4162
- https://github.com/nhost/nhost/releases/tag/auth%400.49.1
- https://github.com/nhost/nhost/security/advisories/GHSA-6g38-8j4p-j3pr
- https://nvd.nist.gov/vuln/detail/CVE-2026-41574
- https://github.com/nhost/nhost
- https://github.com/advisories/GHSA-6g38-8j4p-j3pr
CWEs
CWE-287
Verify integrity in audit chain (admin only). AS-IS.