https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T18:45:53.505602+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-5611 EUVD-2026-5611 2026-10-08T18:45:53.507769+00:00 EUVD-2026-5611 https://cve.radiocsirt.org/vuln/fkie_cve-2024-35232 fkie_cve-2024-35232 2026-10-08T18:45:53.507801+00:00

github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. access_token can be exposed in error message on fail in HTTP request. This issue has been patched in version 2.7.2.

 https://cve.radiocsirt.org/vuln/ghsa-3f65-m234-9mxr GHSA-3f65-m234-9mxr — github.com/huandu/facebook may expose access_token in error message. 2026-10-08T18:45:53.507832+00:00

Affected: Go: github.com/huandu/facebook/v2

### Summary access_token can be exposed in error message on fail in HTTP request.

### Details Using this module, when HTTP request fails, error message can contain access_token. This can be happen when: - module is sending HTTP request with query parameter `?access_token=...`. - and HTTP request fails (errors like `facebook: cannot reach facebook server`).

In such situation, error message is constucted like following. https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567 Original error message contained in it comes from `net/http` module. And it can contain full URL, that can contain query parameter `access_token`: https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633 https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30

It should be very common that applications log error message when they encounter errors. As a result, access_token can be stored into log server and some other infrastructures. Of course other careless error handling in client code that causing other security problems can exist.

I'm not very sure that whether we can consider that github.com/huandu/facebook is vulnerable. Anyway, I think current error message, that can expose access_token, is not desirble.

### PoC Request me this section if you need complete instruction.

### Impact Client applications with following conditions can be affected. - logs error message from this module - or returns er…