The vulnerability in crawlseo causes storage of Google OAuth access and refresh tokens in the User.googleTokens column in plain text. Attackers who can read the database can obtain indefinite, unauthenticated access to all registered users' Google Search Console data. The flaw is a cleartext storage of security‑sensitive data (CWE‑312), leading to credential compromise and unauthorized data access.

The flaw exists in crawlseo releases prior to version 0.2.5. The affected product is the crawlseo application, which uses a PostgreSQL database for storing user credentials. Users running a pre‑0.2.5 release are vulnerable if their database is reachable or can be compromised.

The CVSS score of 6.7 indicates moderate severity. EPSS is not available and the flaw is not listed in CISA’s KEV catalog. Exploitation requires the attacker to have database read privileges or the database to be exposed over the network. Based on the description, the attack vector is inferred to be local or through a compromised database.