CWE-598: Use of HTTP Request With Sensitive Query String

The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.

Consequences

• Confidentiality: Read Application Data

How to prevent it

• Implementation: When sending sensitive information, only include it in the request body or request headers instead of the query string. This may require avoiding use of GET requests.

Recent advisories

• GHSA-hhvr-8m24-qqr3 — ApostropheCMS: Cross-domain session token in URL confers session takeover
• GHSA-pvgv-gcp7-v38g — Nginx UI: Node Secret Credential Exposure via URL Query Parameter
• EEF-CVE-2026-81632 — Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
• GHSA-5w8w-26ch-v5cw — AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover
• GHSA-gcvm-c75m-h4p4 — Apache OpenMeetings Uses GET Request Method With Sensitive Query Strings
• GHSA-4rh7-jwg9-m28m — openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage
• GHSA-x9p5-w45c-7ffc — Gogs: Access tokens get exposed through URL params in API requests
• GHSA-rmwh-g367-mj4x — File Browser allows sensitive data to be transferred in URL
• GHSA-9vc3-vm42-fjhm — Moodle's mod_data edit/delete pages pass CSRF token in GET parameter
• GHSA-m67m-3p5g-cw9j — VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext
• GHSA-2ccr-g2rv-h677 — Session Token in URL in directus
• GHSA-4qq5-mxxx-m6gg — MLflow authentication requirement bypass can allow a user to arbitrarily create an account

All advisories for CWE-598