Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities by jleehr
CVE-2026-55375 (GCVE-0-2026-55375)
Vulnerability from nvd – Published: 2026-09-15 17:30 – Updated: 2026-09-15 19:05
VLAI
EPSS
VEX
Title
canto-saas-api: OAuth credentials exposed in URL query string and exception messages
Summary
canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams() places app_id, app_secret, refresh_token, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credentials in plaintext. When a token request fails, OAuth2::obtainAccessToken() also passes the credential-bearing Guzzle request URI into AuthorizationFailedException, so application logs and error trackers can record the same secrets. An attacker with access to affected telemetry can obtain Canto credentials and use them to request access tokens for the tenant. This issue is fixed in version 3.0.0.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 19:05 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/jleehr/canto-saas-api/security… | x_refsource_CONFIRM |
| https://github.com/jleehr/canto-saas-api/commit/3… | x_refsource_MISC |
| https://github.com/jleehr/canto-saas-api/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jleehr | canto-saas-api |
Affected:
< 3.0.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55375",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T19:05:37.098259Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T19:05:49.862Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "canto-saas-api",
"vendor": "jleehr",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams() places app_id, app_secret, refresh_token, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credentials in plaintext. When a token request fails, OAuth2::obtainAccessToken() also passes the credential-bearing Guzzle request URI into AuthorizationFailedException, so application logs and error trackers can record the same secrets. An attacker with access to affected telemetry can obtain Canto credentials and use them to request access tokens for the tenant. This issue is fixed in version 3.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209: Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-598",
"description": "CWE-598: Use of GET Request Method With Sensitive Query Strings",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T17:30:29.992Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/jleehr/canto-saas-api/security/advisories/GHSA-37pm-83g7-r22v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/jleehr/canto-saas-api/security/advisories/GHSA-37pm-83g7-r22v"
},
{
"name": "https://github.com/jleehr/canto-saas-api/commit/300559fdae5d1bed2dc00a6477f5996833a77339",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jleehr/canto-saas-api/commit/300559fdae5d1bed2dc00a6477f5996833a77339"
},
{
"name": "https://github.com/jleehr/canto-saas-api/releases/tag/3.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jleehr/canto-saas-api/releases/tag/3.0.0"
}
],
"source": {
"advisory": "GHSA-37pm-83g7-r22v",
"discovery": "UNKNOWN"
},
"title": "canto-saas-api: OAuth credentials exposed in URL query string and exception messages"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55375",
"datePublished": "2026-09-15T17:30:29.992Z",
"dateReserved": "2026-06-16T18:57:40.181Z",
"dateUpdated": "2026-09-15T19:05:49.862Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55374 (GCVE-0-2026-55374)
Vulnerability from nvd – Published: 2026-09-15 17:33 – Updated: 2026-09-15 19:44
VLAI
EPSS
VEX
Title
canto-saas-api: Authenticated API requests can be redirected via unencoded path variables
Summary
canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl() joins values returned by Request::getPathVariables() without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When a consuming application supplies an untrusted path variable value, path traversal sequences, query delimiters, or fragment delimiters can change the destination endpoint before AbstractEndpoint::sendRequest() attaches the configured authentication token. An attacker who controls that path variable value through the consuming application can cause unintended reads or writes with the configured application's privileges on the same Canto instance, but applications that pass only trusted and validated identifiers are not exploitable. This issue is fixed in version 3.0.0.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 18:57 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/jleehr/canto-saas-api/security… | x_refsource_CONFIRM |
| https://github.com/jleehr/canto-saas-api/commit/3… | x_refsource_MISC |
| https://github.com/jleehr/canto-saas-api/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jleehr | canto-saas-api |
Affected:
< 3.0.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55374",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T18:57:35.795603Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T19:44:28.217Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "canto-saas-api",
"vendor": "jleehr",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl() joins values returned by Request::getPathVariables() without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When a consuming application supplies an untrusted path variable value, path traversal sequences, query delimiters, or fragment delimiters can change the destination endpoint before AbstractEndpoint::sendRequest() attaches the configured authentication token. An attacker who controls that path variable value through the consuming application can cause unintended reads or writes with the configured application\u0027s privileges on the same Canto instance, but applications that pass only trusted and validated identifiers are not exploitable. This issue is fixed in version 3.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T17:33:14.637Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/jleehr/canto-saas-api/security/advisories/GHSA-9qfv-wgh2-m6p8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/jleehr/canto-saas-api/security/advisories/GHSA-9qfv-wgh2-m6p8"
},
{
"name": "https://github.com/jleehr/canto-saas-api/commit/300559fdae5d1bed2dc00a6477f5996833a77339",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jleehr/canto-saas-api/commit/300559fdae5d1bed2dc00a6477f5996833a77339"
},
{
"name": "https://github.com/jleehr/canto-saas-api/releases/tag/3.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jleehr/canto-saas-api/releases/tag/3.0.0"
}
],
"source": {
"advisory": "GHSA-9qfv-wgh2-m6p8",
"discovery": "UNKNOWN"
},
"title": "canto-saas-api: Authenticated API requests can be redirected via unencoded path variables"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55374",
"datePublished": "2026-09-15T17:33:14.637Z",
"dateReserved": "2026-06-16T18:57:40.181Z",
"dateUpdated": "2026-09-15T19:44:28.217Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55374 (GCVE-0-2026-55374)
Vulnerability from cvelistv5 – Published: 2026-09-15 17:33 – Updated: 2026-09-15 19:44
VLAI
EPSS
VEX
Title
canto-saas-api: Authenticated API requests can be redirected via unencoded path variables
Summary
canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl() joins values returned by Request::getPathVariables() without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When a consuming application supplies an untrusted path variable value, path traversal sequences, query delimiters, or fragment delimiters can change the destination endpoint before AbstractEndpoint::sendRequest() attaches the configured authentication token. An attacker who controls that path variable value through the consuming application can cause unintended reads or writes with the configured application's privileges on the same Canto instance, but applications that pass only trusted and validated identifiers are not exploitable. This issue is fixed in version 3.0.0.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 18:57 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/jleehr/canto-saas-api/security… | x_refsource_CONFIRM |
| https://github.com/jleehr/canto-saas-api/commit/3… | x_refsource_MISC |
| https://github.com/jleehr/canto-saas-api/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jleehr | canto-saas-api |
Affected:
< 3.0.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55374",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T18:57:35.795603Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T19:44:28.217Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "canto-saas-api",
"vendor": "jleehr",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl() joins values returned by Request::getPathVariables() without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When a consuming application supplies an untrusted path variable value, path traversal sequences, query delimiters, or fragment delimiters can change the destination endpoint before AbstractEndpoint::sendRequest() attaches the configured authentication token. An attacker who controls that path variable value through the consuming application can cause unintended reads or writes with the configured application\u0027s privileges on the same Canto instance, but applications that pass only trusted and validated identifiers are not exploitable. This issue is fixed in version 3.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T17:33:14.637Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/jleehr/canto-saas-api/security/advisories/GHSA-9qfv-wgh2-m6p8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/jleehr/canto-saas-api/security/advisories/GHSA-9qfv-wgh2-m6p8"
},
{
"name": "https://github.com/jleehr/canto-saas-api/commit/300559fdae5d1bed2dc00a6477f5996833a77339",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jleehr/canto-saas-api/commit/300559fdae5d1bed2dc00a6477f5996833a77339"
},
{
"name": "https://github.com/jleehr/canto-saas-api/releases/tag/3.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jleehr/canto-saas-api/releases/tag/3.0.0"
}
],
"source": {
"advisory": "GHSA-9qfv-wgh2-m6p8",
"discovery": "UNKNOWN"
},
"title": "canto-saas-api: Authenticated API requests can be redirected via unencoded path variables"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55374",
"datePublished": "2026-09-15T17:33:14.637Z",
"dateReserved": "2026-06-16T18:57:40.181Z",
"dateUpdated": "2026-09-15T19:44:28.217Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55375 (GCVE-0-2026-55375)
Vulnerability from cvelistv5 – Published: 2026-09-15 17:30 – Updated: 2026-09-15 19:05
VLAI
EPSS
VEX
Title
canto-saas-api: OAuth credentials exposed in URL query string and exception messages
Summary
canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams() places app_id, app_secret, refresh_token, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credentials in plaintext. When a token request fails, OAuth2::obtainAccessToken() also passes the credential-bearing Guzzle request URI into AuthorizationFailedException, so application logs and error trackers can record the same secrets. An attacker with access to affected telemetry can obtain Canto credentials and use them to request access tokens for the tenant. This issue is fixed in version 3.0.0.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 19:05 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/jleehr/canto-saas-api/security… | x_refsource_CONFIRM |
| https://github.com/jleehr/canto-saas-api/commit/3… | x_refsource_MISC |
| https://github.com/jleehr/canto-saas-api/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jleehr | canto-saas-api |
Affected:
< 3.0.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55375",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T19:05:37.098259Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T19:05:49.862Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "canto-saas-api",
"vendor": "jleehr",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams() places app_id, app_secret, refresh_token, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credentials in plaintext. When a token request fails, OAuth2::obtainAccessToken() also passes the credential-bearing Guzzle request URI into AuthorizationFailedException, so application logs and error trackers can record the same secrets. An attacker with access to affected telemetry can obtain Canto credentials and use them to request access tokens for the tenant. This issue is fixed in version 3.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209: Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-598",
"description": "CWE-598: Use of GET Request Method With Sensitive Query Strings",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T17:30:29.992Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/jleehr/canto-saas-api/security/advisories/GHSA-37pm-83g7-r22v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/jleehr/canto-saas-api/security/advisories/GHSA-37pm-83g7-r22v"
},
{
"name": "https://github.com/jleehr/canto-saas-api/commit/300559fdae5d1bed2dc00a6477f5996833a77339",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jleehr/canto-saas-api/commit/300559fdae5d1bed2dc00a6477f5996833a77339"
},
{
"name": "https://github.com/jleehr/canto-saas-api/releases/tag/3.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jleehr/canto-saas-api/releases/tag/3.0.0"
}
],
"source": {
"advisory": "GHSA-37pm-83g7-r22v",
"discovery": "UNKNOWN"
},
"title": "canto-saas-api: OAuth credentials exposed in URL query string and exception messages"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55375",
"datePublished": "2026-09-15T17:30:29.992Z",
"dateReserved": "2026-06-16T18:57:40.181Z",
"dateUpdated": "2026-09-15T19:05:49.862Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}