How severe is GHSA-7hgr-xvrr-xpw3?

No CVSS score has been assigned to GHSA-7hgr-xvrr-xpw3 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-7hgr-xvrr-xpw3?

GHSA-7hgr-xvrr-xpw3 affects the following packages: github.com/nhost/nhost (Go). Ecosystems affected: Go.

How do I fix GHSA-7hgr-xvrr-xpw3?

Update github.com/nhost/nhost to 0.0.0-20260430132514-52c70664a7e9 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-7hgr-xvrr-xpw3 is resolved across your whole dependency graph.

How do I detect GHSA-7hgr-xvrr-xpw3 in my Go dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/nhost/nhost, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-7hgr-xvrr-xpw3 if there is no patch (or I can't update yet)?

Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Is GHSA-7hgr-xvrr-xpw3 actively exploited in the wild?

No public exploit code has been indexed for GHSA-7hgr-xvrr-xpw3 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-7hgr-xvrr-xpw3 published, and has it been updated?

GHSA-7hgr-xvrr-xpw3 was published on May 8, 2026 and was last updated on June 25, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐹 Go

Not in CISA KEV

nhost has Session Persistence After Password ChangeGHSA-7hgr-xvrr-xpw3

Fix: nhost/nhost@52c7066

GHSA-7hgr-xvrr-xpw3 is a security vulnerability in github.com/nhost/nhost. A fix is available for github.com/nhost/nhost — see the affected versions and patch details below.

Also known asGO-2026-5222

Published

May 8, 2026

Updated

Jun 25, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Jun 25, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

🐹github.com/nhost/nhost

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

When a user changes their password, either through the authenticated password change endpoint or a password reset ticket, the ChangePassword workflow correctly hashes and persists the new password via UpdateUserChangePassword. However, it does not revoke existing sessions. The auth.refresh_tokens and auth.oauth2_refresh_tokens tables are left untouched, meaning all previously issued refresh tokens remain valid and can continue generating new access tokens indefinitely.

This vulnerability affects all password change paths (handled in change_user_password.go), since they share the same underlying workflow:

Authenticated password change via the Nhost dashboard or client SDK
Ticket-based password reset (magic links / recovery flows)
OAuth2/OIDC sessions managed via auth.oauth2_refresh_tokens

Attack Scenario

An attacker steals a victim's refresh token via XSS or a compromised device.
The victim changes their password, expecting it to terminate all active sessions.
The server updates password_hash but performs no session cleanup, the stolen token remains fully functional.

Impact

The attacker retains persistent access even after the victim's password change. This is especially severe in credential theft scenarios, where the victim's only recovery action does nothing against an active session. Depending on configured TTL, the attacker's window could be days or weeks.

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🐹Go	`github.com/nhost/nhost`	all versions	0.0.0-20260430132514-52c70664a7e9`go get github.com/nhost/nhost@v0.0.0-20260430132514-52c70664a7e9`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/nhost/nhost, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/nhost/nhost to 0.0.0-20260430132514-52c70664a7e9 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-7hgr-xvrr-xpw3 is resolved across your whole dependency graph.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

## Description When a user changes their password, either through the authenticated password change endpoint or a password reset ticket, the [`ChangePassword`](https://github.com/nhost/nhost/blob/main/services/auth/go/controller/workflows.go#L731-L759) workflow correctly hashes and persists the new password via [`UpdateUserChangePassword`](https://github.com/nhost/nhost/blob/main/services/auth/go/sql/query.sql#L314-L318). However, it does not revoke existing sessions. The `auth.refresh_tokens` and `auth.oauth2_refresh_tokens` tables are left untouched, meaning all previously issued refresh to

O3 Security · Impact-Aware SCA

Is GHSA-7hgr-xvrr-xpw3 in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works

nhost has Session Persistence After Password ChangeGHSA-7hgr-xvrr-xpw3

Real-World Exposure

Description

Description

Attack Scenario

Impact

Affected Packages

Detection & mitigation playbook

Detect

Fix

Workarounds

Frequently Asked Questions

Is GHSA-7hgr-xvrr-xpw3 in your dependencies?