CVE-2026-55375
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams() places app_id, app_secret, refresh_token, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credentials in plaintext. When a token request fails, OAuth2::obtainAccessToken() also passes the credential-bearing Guzzle request URI into AuthorizationFailedException, so application logs and error trackers can record the same secrets.
Risk Assessment
An attacker with access to affected telemetry can obtain Canto credentials and use them to request access tokens for the tenant.
Recommendation
Update canto-saas-api to version 3.0.0 or later and review and sanitize logs containing credentials.
Other vulnerabilities in canto-saas-api
Original NVD description (English source)
canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams() places app_id, app_secret, refresh_token, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credentials in plaintext. When a token request fails, OAuth2::obtainAccessToken() also passes the credential-bearing Guzzle request URI into AuthorizationFailedException, so application logs and error trackers can record the same secrets. An attacker with access to affected telemetry can obtain Canto credentials and use them to request access tokens for the tenant. This issue is fixed in version 3.0.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS