CVE-2026-55375

Executive Summary

CVE-2026-55375 is a credential-exposure vulnerability in canto-saas-api, a PHP library used to interact with the Canto SaaS API, affecting versions prior to 3.0.0. OAuth2 credential material (app_id, app_secret, refresh_token, and code) is placed in the URL query string of token POST requests and, additionally, embedded into a thrown exception's request URI, causing secrets to be persisted in plaintext in access logs, proxy logs, APM traces, and application error trackers. An attacker with read access to any of those telemetry sources can recover Canto credentials and request access tokens for the affected tenant, resulting in unauthorized access to the tenant's Canto asset management data.

Technical Analysis

The vulnerability is a sensitive-information-in-query-string / information-exposure-through-error-message issue (CWE-209), located in the PHP library's OAuth2 token-exchange flow.

Two distinct disclosure sinks are described:

1. Query-string credential transport. The method OAuth2Request::getQueryParams() places four credential values — app_id, app_secret, refresh_token, and code — into the URL query string of token POST requests. Because query strings are routinely captured verbatim by reverse proxies, load balancers, CDN edge logs, WAF logs, APM tracing agents, and HTTP server access logs, the secrets become durable plaintext artifacts at rest in operational telemetry. This is a well-known anti-pattern: OAuth2 token and authentication material should be transmitted in the request body (and over TLS), never in the URI, precisely because the URI is the component most commonly logged.

2. Exception-embedded credentials. When a token request fails, OAuth2::obtainAccessToken() passes the credential-bearing Guzzle request URI into AuthorizationFailedException. Because the URI still contains the query-string credentials, the exception message/context — and therefore application logs, error trackers, and crash-reporting pipelines — can record the same secrets. This creates a second, independent exfiltration surface that does not require proxy or access-log access.

Attack surface. The exposure surface is telemetry, not the network path to Canto. The vulnerable library runs client-side within integrator applications, but the leaked secrets are for the Canto tenant. Any actor who can read logs or traces produced by an integrating application — a compromised logging pipeline, an over-permissive SIEM, a shared APM tenant, an insider with log access, or a supply-chain compromise of the logging service — can harvest the credentials.

Preconditions and scoring. CVSS 3.1 is 5.3 (Medium): AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. The AC:H reflects the requirement for non-default conditions — specifically that an attacker must gain access to affected telemetry — and PR:L reflects that some low-privileged log/telemetry access is required. Confidentiality impact is High because successful extraction yields usable OAuth2 credentials. There is no integrity or availability impact from the vulnerability itself (though post-exploitation actions against the Canto tenant are a separate consequence).

Root cause class. Secrets in URIs plus secrets in exceptions. Correct implementations pass credentials in the POST body, redact exception URIs, and avoid logging full request objects.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code exists, and EPSS is 0.00251 (16.7th percentile), indicating low near-term exploitation likelihood. The chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. The attacker identifies organizations that integrate with the Canto SaaS API using a vulnerable version of the canto-saas-api PHP library. Relevant signals include dependency manifests, OSV/SCA alerts for canto-saas-api < 3.0.0, and exposure of logging/APM infrastructure. The attacker does not need to touch the Canto API itself at this stage; the target is the integrator's telemetry stack.

2. Triggering the flawed behavior. The vulnerability triggers during normal operation: any OAuth2 token request issued through the library writes app_id, app_secret, refresh_token, and code into the request URI via OAuth2Request::getQueryParams(). No attacker action is required for the secrets to be emitted — they are logged passively by any component that records request URIs. Separately, a failed token request causes OAuth2::obtainAccessToken() to pass the credential-bearing URI into AuthorizationFailedException, writing the secrets into application logs and error trackers.

3. Credential harvesting (vulnerability-class level). The attacker obtains the leaked URIs from one of the following sources: HTTP access logs, reverse-proxy or load-balancer logs, CDN/WAF logs, APM traces, application logs, or exception/error-tracker payloads. From a captured token request URI the attacker extracts the app_id, app_secret, refresh_token, and code parameters. TLS does not mitigate this: the data is exposed at rest in telemetry, after decryption at the endpoint.

4. Post-exploitation impact. Using the harvested app_id/app_secret (and refresh_token), the attacker authenticates to the Canto OAuth2 endpoint and requests access tokens for the victim tenant, as explicitly stated in the NVD description. This grants API-level access to the tenant's Canto resources consistent with the credential's scope. Because the refresh token may be long-lived, access can persist beyond the initial leak. Note: the description does not specify which API operations are subsequently available; scope is bounded by the issued token.

Impact Assessment

• Confidentiality: High. Successful extraction yields working Canto OAuth2 credentials and refresh tokens, enabling unauthorized token acquisition for the tenant.
• Integrity: None (per CVSS), Availability: None (per CVSS). Direct impact of the flaw is disclosure only.
• Attack complexity: High; Privileges required: Low — the attacker needs read access to affected telemetry (logs, traces, or error trackers).
• Blast radius. Every application, CI/CD job, or serverless function that uses canto-saas-api < 3.0.0 and logs request URIs is a potential leak point. A single captured URI compromises credentials for an entire Canto tenant, and because the same secrets appear in multiple log sinks (access logs and exception payloads), the leak probability is multiplied.
• Business impact. Unauthorized access to the tenant's digital asset management (DAM) content — which frequently includes unpublished marketing assets, brand material, and customer-facing media — plus potential downstream abuse of the Canto integration. Credential reuse across environments amplifies impact.
• Patch confidence is low (2/4, CLAIMED). The fix version (3.0.0) is asserted by a single OSV source and is not independently confirmed by a vendor advisory; teams should verify before relying on it.

Detection Guidance

The exploitable event is the presence of secrets in URIs, and secondarily the use of harvested credentials. Detection should therefore hunt for credential-bearing query strings in logs and for anomalous token requests.

Sigma Rule

title: Canto SaaS API OAuth Credentials Exposed in URI Query String
id: 8b6f0c1e-3a2d-4f7b-9c15-55375canto
status: experimental
description: Detects HTTP request URIs or application log lines containing OAuth2 credential parameters (app_secret, refresh_token) in the query string, indicative of CVE-2026-55375 in canto-saas-api before 3.0.0.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-55375
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: web
  product: generic
detection:
  selection_params:
    - 'app_secret='
    - 'refresh_token='
  selection_context:
    - 'canto'
    - 'OAuth2Request'
    - 'obtainAccessToken'
  condition: selection_params and selection_context
falsepositives:
  - Legitimate non-secret uses of similarly named parameters
level: high
tags:
  - attack.credential_access
  - attack.t1552
  - cve.2026.55375

YARA Rule

rule CVE_2026_55375_Canto_OAuth_Secrets_In_URI
{
    meta:
        description = "Detects canto-saas-api source or log artifacts leaking OAuth2 credentials in query strings (CVE-2026-55375)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-55375"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $p1 = "app_secret"
        $p2 = "refresh_token"
        $p3 = "app_id"
        $p4 = "getQueryParams"
        $p5 = "obtainAccessToken"
        $p6 = "AuthorizationFailedException"
        $q1 = "?app_id=" ascii
        $q2 = "&app_secret=" ascii
        $q3 = "&refresh_token=" ascii

    condition:
        (uint32(0) == 0x3C3F7068) and
        ( 2 of ($p*) or 1 of ($q*) )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-55375 Canto OAuth Secret in URI Query String"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"app_secret="; nocase; http.uri; content:"refresh_token="; nocase; reference:cve,2026-55375; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-55375; classtype:attempted-recon; sid:202655375; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=30m
  [ network where http.request.method == "POST" and
      stringContains(http.request.body.content, "app_secret") == false and
      stringContains(url.query, "app_secret") == true and
      stringContains(url.query, "refresh_token") == true ]

(Event-based alternative, for log ingestion that captures full URLs: match any HTTP access-log or proxy-log event whose URL query string contains app_secret together with refresh_token or app_id.)

Splunk SPL Query

index=web OR index=proxy OR index=apm sourcetype=access_combined OR sourcetype=proxy
| regex _raw="(?i)(app_secret|refresh_token)=[^&\s]+"
| regex _raw="(?i)canto|OAuth2Request|obtainAccessToken"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_host, uri_path
| where count > 0
| sort - last_seen

Wazuh OSSEC Rule

<group name="canto,cve-2026-55375,web,">
  <rule id="202655375" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <regex type="pcre2">(?i)(app_secret|refresh_token)=[^&amp;\s]+</regex>
    <regex type="pcre2">(?i)(canto|OAuth2Request|obtainAccessToken)</regex>
    <description>CVE-2026-55375: Canto OAuth2 credentials exposed in URI query string</description>
    <mitre>
      <id>T1552</id>
    </mitre>
    <group>credential_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

1. Immediate mitigations (while unpatched)

   • Move OAuth2 credential parameters out of the URI: ensure token requests transmit app_id, app_secret, refresh_token, and code in the POST body, not the query string.
   • Sanitize exception construction so AuthorizationFailedException never receives or logs the credential-bearing Guzzle request URI; redact sensitive query parameters before logging.
   • Scrub existing telemetry: rotate/revoke all app_secret and refresh_token values that may have been emitted, then purge or restrict access to historical access logs, proxy logs, APM traces, and error-tracker records that contain the secrets.
   • Restrict log/trace access to least privilege and enable encryption/retention controls on logging pipelines.

2. Patch / upgrade steps

   • Upgrade canto-saas-api to version 3.0.0 or later, where the issue is reported fixed. Verify the fix against the vendor's repository/advisory before relying on it (single-source claim).
   • After upgrade, validate that token requests no longer place credentials in the URI and that exceptions no longer include the request URI.

3. Long-term hardening

   • Adopt a policy that no secret material ever appears in URLs, and enforce it via code review and linting.
   • Stand up secret-scanning over logs and telemetry (the Sigma/YARA rules above) and alert on any credential patterns in URIs.
   • Shorten OAuth2 refresh-token lifetimes and implement rotation so a leaked token has a bounded useful life.
   • Scope Canto credentials to the minimum required permissions, and monitor the Canto API for anomalous token requests originating from unexpected sources.

References

1. NVD — CVE-2026-55375: https://nvd.nist.gov/vuln/detail/CVE-2026-55375
2. OSV — canto-saas-api advisory (patch reference for 3.0.0): https://osv.dev/
3. CWE-209 — Generation of Error Message Containing Sensitive Information: https://cwe.mitre.org/data/definitions/209.html
4. Canto SaaS API OAuth2 documentation: https://api.canto.com/
5. EPSS — CVE-2026-55375 (score 0.00251, 16.7th percentile): https://www.first.org/epss/

Threat actor campaigns / exploit-in-the-wild: none known. CISA KEV status is NO; no public PoC, Nuclei template, or exploit code is available. Exploitation requires access to affected telemetry, and the flaw is a passive credential-leak rather than a remotely triggerable exploit.