{"answers":{"affected":"3 open source packages ship an affected version, including github.com/nhost/nhost.","exploited":"There is no known exploitation of GHSA-7hgr-xvrr-xpw3 in the wild and no public exploit code.","fix":"Upgrade github.com/nhost/nhost to 0.0.0-20260430132514-52c70664a7e9 or later.","what":"GHSA-7hgr-xvrr-xpw3 is a vulnerability in github.com/nhost/nhost, published on 8 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-7hgr-xvrr-xpw3 and fix it if it is affected.\n\nWhat it is: GHSA-7hgr-xvrr-xpw3 is a vulnerability in github.com/nhost/nhost, published on 8 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-7hgr-xvrr-xpw3 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/nhost/nhost (Go): affected all versions; fixed in 0.0.0-20260430132514-52c70664a7e9\n- github.com/nhost/nhost (Go): affected all versions; fixed in 0.0.0-20260430132514-52c70664a7e9\n- github.com/nhost/nhost (Go): affected all versions; fixed in 0.0.0-20260430132514-52c70664a7e9\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-7hgr-xvrr-xpw3/ (Markdown: https://insights.sbomify.com/GHSA-7hgr-xvrr-xpw3/index.md)","id":"GHSA-7hgr-xvrr-xpw3","markdown":"https://insights.sbomify.com/GHSA-7hgr-xvrr-xpw3/index.md","name":"GHSA-7hgr-xvrr-xpw3","record":{"aliases":["GO-2026-5222"],"analysis":{"component_type":"server_software","fix_type":"patch","impacts":["account_takeover","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Nhost authentication service","requires_auth":"low_privilege","summary":"Attackers retain access via stolen refresh tokens after victims change passwords because existing sessions are not revoked.","user_interaction":"required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Description\n\nWhen a user changes their password, either through the authenticated password change endpoint or a password reset ticket, the [`ChangePassword`](https://github.com/nhost/nhost/blob/main/services/auth/go/controller/workflows.go#L731-L759) workflow correctly hashes and persists the new password via [`UpdateUserChangePassword`](https://github.com/nhost/nhost/blob/main/services/auth/go/sql/query.sql#L314-L318). However, it does not revoke existing sessions. The `auth.refresh_tokens` and `auth.oauth2_refresh_tokens` tables are left untouched, meaning all previously issued refresh tokens remain valid and can continue generating new access tokens indefinitely.\n\nThis vulnerability affects all password change paths (handled in [`change_user_password.go`](https://github.com/nhost/nhost/blob/main/services/auth/go/controller/change_user_password.go)), since they share the same underlying workflow:\n\n- Authenticated password change via the Nhost dashboard or client SDK\n- Ticket-based password reset (magic links / recovery flows)\n- OAuth2/OIDC sessions managed via `auth.oauth2_refresh_tokens`\n\n## Attack Scenario\n\n1. An attacker steals a victim's refresh token via XSS or a compromised device.\n2. The victim changes their password, expecting it to terminate all active sessions.\n3. The server updates `password_hash` but performs no session cleanup, the stolen token remains fully functional.\n\n## Impact\n\nThe attacker retains persistent access even after the victim's password change. This is especially severe in credential theft scenarios, where the victim's only recovery action does nothing against an active session. Depending on configured TTL, the attacker's window could be days or weeks.","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"nhost has Session Persistence After Password Change","id":"GHSA-7hgr-xvrr-xpw3","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"security_feature_bypass","year":"2026"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"Go","fixed":["0.0.0-20260430132514-52c70664a7e9"],"introduced":["0"],"last_affected":[],"package":"github.com/nhost/nhost","purl":null,"source":"GHSA-7hgr-xvrr-xpw3"},{"ecosystem":"Go","fixed":["0.0.0-20260430132514-52c70664a7e9"],"introduced":["0"],"last_affected":[],"package":"github.com/nhost/nhost","purl":"pkg:golang/github.com/nhost/nhost","source":"GHSA-7hgr-xvrr-xpw3"},{"ecosystem":"Go","fixed":["0.0.0-20260430132514-52c70664a7e9"],"introduced":["0"],"last_affected":[],"package":"github.com/nhost/nhost","purl":"pkg:golang/github.com/nhost/nhost","source":"GO-2026-5222"}],"products":null,"published":"2026-05-08","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers retain access via stolen refresh tokens after victims change passwords because existing sessions are not revoked.","url":"https://insights.sbomify.com/GHSA-7hgr-xvrr-xpw3/"}