Cleartext Storage Vulnerability in CrawlSEO Product by CrawlSEO

CVE-2026-115400

What is CVE-2026-115400?

CrawlSEO prior to version 0.2.5 is susceptible to a cleartext storage vulnerability that compromises user security. This issue allows attackers with database read access to retrieve unencrypted Google OAuth access and refresh tokens stored in the User.googleTokens column. As a result, attackers can extract plaintext long-lived refresh tokens from a vulnerable or accessed PostgreSQL database, enabling them to gain unauthorized, indefinite access to the Google Search Console data of all registered users.

References