CWE-598: Use of HTTP Request With Sensitive Query String
Filter
The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.
What the weakness is: CWE-598 at MITRE. OWASP Top 10: A06:2025 Insecure Design
Ask an AI about CWE-598
Show the prompt
Explain CWE-598: Use of HTTP Request With Sensitive Query String and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/598.html and https://cve.bz/cve/cwe/598?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.3CVE-2026-113669EPSS 0.4%
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A cl…
- 5.3CVE-2026-107370EPSS 0.3%
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is app…
- 1.2CVE-2026-108808EPSS 0.2%
A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipula…
- 8.8CVE-2026-107807EPSS 0.3%
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring t…
- 7.2CVE-2026-81632EPSS 0.2%
Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its own…
- 5.3CVE-2026-55375EPSS 0.4%
canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams() places app_id, app_secret, refresh_token, and code in the URL query string of token POST requests, allowing ac…
- 6.5CVE-2026-50157EPSS 0.5%
Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() and Authorizer::supports() paths in the Authorizer security authenticator may accept OAuth 2.0 bearer…
- 8.2CVE-2026-88897EPSS 0.6%
Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant f…
- 5.9CVE-2026-61614EPSS 0.4%
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a `?token=` URL query parameter as a fallback to the `X-API-TOKEN` header. This causes long-lived API credentia…
- 6.8CVE-2026-82181EPSS 0.2%
Medical Practice Management System developed by Le-yan has a Sensitive Data in URL vulnerability. Unauthenticated remote attackers can obtain sensitive information via victim's browser history or log files.
- 9.3CVE-2026-76179EPSS 0.7%
An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which m…
- 7.5CVE-2026-63408EPSS 0.5%
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter on …
- 9.3CVE-2026-74880EPSS 0.6%
openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unau…
- 6.9CVE-2026-66832EPSS 0.4%
When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent …
- 7.4CVE-2026-14838EPSS 0.3%
Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking. This issue affects HUMANIST Digital Human Resources: from 2…
- 5.5CVE-2026-47768EPSS 0.2%
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs). This issue has been patched in version …
- 6.3CVE-2026-16207EPSS 0.6%
A vulnerability was detected in django-tastypie up to 0.15.1. Impacted is the function ApiKeyAuthentication of the file tastypie/authentication.py. The manipulation results in use of get request method with sensitive query strings. The att…
- 7.5CVE-2026-15322EPSS 0.5%
IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive information due to the exposure of session tokens in URLs.
- 7.5CVE-2026-9592EPSS 0.2%
SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web portal, as the session token is disclosed inside the URL and a HTTP header.
- 8.2CVE-2026-62386EPSS 0.3%
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractBearerToken fallback). Because tokens are embedded in URLs, the…
- 8.1CVE-2026-54652EPSS 0.3%
Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user including the viewer role to download Frigate and nginx logs, exposing auto-generated admin passwords a…
- 8.7CVE-2026-58656EPSS 0.4%
Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: *, allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any …
- 2.7CVE-2026-10078EPSS 0.2%
A flaw was found in the Quay config-tool's GitLab OAuth validator. This vulnerability causes sensitive credentials, specifically client_id and client_secret, to be transmitted as plaintext in URL query parameters during POST requests to th…
- 7.7CVE-2026-44883EPSS 0.3%
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer's …
- 5.5CVE-2026-2237EPSS 0.09%
A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local users on Windows to obtain sensitive information.
- 2.6CVE-2025-62317EPSS 0.1%
HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters. Passing sensitive data in URLs may expose it through browser history, logs, or intermediary systems, potentially leading to unintended i…
- 6.8CVE-2026-43875EPSS 0.3%
WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/MobileManager/oauth2.php completes an OAuth login by sending an HTTP 302 Location: oauth2Success.php?user=<email>&pass=<HASH> where <HASH> is the vi…
- 7.5CVE-2026-37504EPSS 0.3%
Sensitive server_token exposed via GET parameter in V2Board thru 1.7.4. In app/Http/Controllers/Server/UniProxyController.php, the server authentication token is accepted via GET parameter transmission. The token appears in URLs such as /a…
- 7.5CVE-2026-34020EPSS 0.5%
Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings. The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible im…
- 4.3CVE-2026-27949EPSS 0.2%
Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling (e.g., when an…
- 2.3CVE-2026-34969EPSS 0.3%
Nhost is an open source Firebase alternative with GraphQL. Prior to 0.48.0, the auth service's OAuth provider callback flow places the refresh token directly into the redirect URL as a query parameter. Refresh tokens in URLs are logged in …
- 6.3CVE-2026-25118EPSS 0.5%
immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable to credential disclosure when a user authenticates to a shared album. During the authentication proc…
- 4.3CVE-2026-33620EPSS 0.3%
PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.7.8` through `v0.8.3` accepted the API token from a `token` URL query parameter in addition to the `Authorization` header. When a …
- 3.1CVE-2025-14808EPSS 0.2%
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to process a request which could be obtained using man in the middle techniques.
- 5.3CVE-2026-31381EPSS 0.3%
An attacker can extract user email addresses (PII) exposed in base64 encoding via the state parameter in the OAuth callback URL.
- 5.9CVE-2025-14811EPSS 0.2%
IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to process a request which could be obtained us…
- 7.5CVE-2025-13219EPSS 0.4%
IBM Aspera Orchestrator 3.0.0 through 4.1.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history.
- 7.5CVE-2025-41772EPSS 0.4%
An unauthenticated remote attacker can obtain valid session tokens because they are exposed in plaintext within the URL parameters of the wwwupdate.cgi endpoint in UBR.
- 6.9CVE-2026-26196EPSS 0.3%
Gogs is an open source self-hosted Git service. Prior to version 0.14.2, gogs api still accepts tokens in url params like token and access_token, which can leak through logs, browser history, and referrers. This issue has been patched in v…
- 5.9CVE-2025-59873EPSS 0.3%
An information exposure vulnerability exists in Vulnerability in HCL Software ZIE for Web. The application transmits sensitive session tokens and authentication identifiers within the URL query parameters . An attacker who gains access t…
- 7.1CVE-2026-26721EPSS 0.3%
An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to obtain sensitive information via the sid query parameter.
- 9.0CVE-2025-69634EPSS 0.2%
Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges via the notes field in perms.php NOTE: this is disputed by a third party who indicates that exploitation can only occur…
- 9.1CVE-2026-23846EPSS 0.5%
Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passw…
- 7.5CVE-2026-22644EPSS 0.5%
Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer headers, which could allow an attacker to hijack the user's session and gain una…
- 2.3CVE-2025-69270EPSS 0.3%
Information Exposure Through Query Strings in GET Request vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Session Hijacking.This issue affects DX NetOps Spectrum: 24.3.8 and earlier.
- 6.5CVE-2025-36371EPSS 0.3%
IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 are impacted by obtaining an information vulnerability in the database plan cache implementation. A user with access to the database plan cache could see information they do not have authority to view.
- 4.3CVE-2025-31954EPSS 0.2%
HCL iAutomate v6.5.1 and v6.5.2 is susceptible to a sensitive information disclosure. An HTTP GET method is used to process a request and includes sensitive information in the query string of that request. An attacker could potentially a…
- 1.0CVE-2025-32916EPSS 0.2%
Potential use of sensitive information in GET requests in Checkmk GmbH's Checkmk versions <2.4.0p13, <2.3.0p38, <2.2.0p46, and 2.1.0 (EOL) may cause sensitive form data to be included in URL query parameters, which may be logged in various…
- 7.5CVE-2025-58584EPSS 0.4%
In the HTTP request, the username and password are transferred directly in the URL as parameters. However, URLs can be stored in various systems such as server logs, browser histories or proxy servers. As a result, there is a high risk tha…
- 8.2CVE-2025-56551EPSS 0.4%
An issue in DirectAdmin v1.680 allows unauthorized attackers to manipulate the page layout and replace the legitimate login interface with arbitrary attacker-controlled content via supplying a crafted GET request.