---
id: CVE-2024-35232
aliases:
  - GHSA-3f65-m234-9mxr
  - GO-2024-2882
title: github.com/huandu/facebook may expose access_token in error message.
summary: github.com/huandu/facebook may expose access_token in error message.
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
vendor: huandu
product: github.com/huandu/facebook/v2
ecosystem: go
affected:
  - github.com/huandu/facebook/v2 < 2.7.2
patched:
  - github.com/huandu/facebook/v2 2.7.2
published: '2024-05-24'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:11.536052949Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-3f65-m234-9mxr'
references:
  - url: 'https://github.com/huandu/facebook/security/advisories/GHSA-3f65-m234-9mxr'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-35232'
  - url: >-
      https://github.com/huandu/facebook/commit/8b34431b91b32903c8821b1d7621bf81a029d8e4
  - url: >-
      https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633
  - url: >-
      https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30
  - url: 'https://github.com/huandu/facebook'
  - url: >-
      https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567
tags:
  - osv
  - go
epss: 0.00504
epssPercentile: 0.42092
ingestedAt: '2026-09-12T03:13:01.749Z'
---

## Overview

### Summary
access_token can be exposed in error message on fail in HTTP request.

### Details
Using this module, when HTTP request fails, error message can contain access_token. This can be happen when:
- module is sending HTTP request with query parameter `?access_token=...`.
- and HTTP request fails (errors like `facebook: cannot reach facebook server`).

In such situation, error message is constucted like following.
https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567
Original error message contained in it comes from `net/http` module. And it can contain full URL, that can contain query parameter `access_token`:
https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633
https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30

It should be very common that applications log error message when they encounter errors. As a result, access_token can be stored into log server and some other infrastructures. Of course other careless error handling in client code that causing other security problems can exist.

I'm not very sure that whether we can consider that github.com/huandu/facebook is vulnerable. Anyway, I think current error message, that can expose access_token, is not desirble.

### PoC
Request me this section if you need complete instruction.

### Impact
Client applications with following conditions can be affected.
- logs error message from this module
- or returns error message to client as something like HTTP response.
- or uses error messages somewhere


## Affected packages

- `github.com/huandu/facebook/v2 < 2.7.2`

## Remediation

Upgrade to a patched release:

- `github.com/huandu/facebook/v2 2.7.2`