Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-32138: NEXULEAN leaks API keys allowing unauthenticated access

CVE-2026-32138 · published 7 months ago

Summary

Versions of NEXULEAN before 2.0.0 expose Firebase and Web3Forms API keys in the code. Because the keys are visible, anyone could call the backend services without a login and possibly view or modify application data. Upgrade to version 2.0.0 or later, which removes the exposed keys, to stop this risk.

Original advisory text

NEXULEAN API Key Leak

NEXULEAN is a cybersecurity portfolio & service platform for an Ethical Hacker, AI Enthusiast, and Penetration Tester. Prior to 2.0.0, a security vulnerability was identified where Firebase and Web3Forms API keys were exposed. An attacker could use these keys to interact with backend services without authentication, potentially leading to unauthorized access to application resources and user data. This vulnerability is fixed in 2.0.0.

References

https://github.com/Stalin-143/website/releases/tag/v2.0.0 URL
https://github.com/Stalin-143/website/security/advisories/GHSA-r7cr-5wcx-x9wm Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32138... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-32138 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.2 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-284Improper Access Control

CWE-798Use of Hard-coded Credentials

Timeline

Published12 Mar 2026

Updated4 Nov 2026

First seen12 Mar 2026

Sources

CVE-2026-32138 · NVD

CVE-2026-32138 · OSV

GHSA-r7cr-5wcx-x9wm · GHSA

Track software like this

Free during beta