CVE-2026-107177CWE-1394

CVE-2026-107177

Medium · published October 7, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
23.3
In the wild
Unconfirmed
What it is

Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decrypt tokenEncrypted values and combine them with stored token IDs to obtain valid bearer tokens for any user.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
7.4 · CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00316 · 23.3th percentile
Weakness
CWE-1394 · Use of Default Cryptographic Key
Published
2026-10-07T17:17Z
References (6)
https://github.com/ExpressGateway/express-gateway · [email protected]https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/config/system.config.yml#L15-L22 · [email protected]https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/services/utils.js#L18-L28 · [email protected]https://github.com/ExpressGateway/express-gateway/issues/1078 · [email protected]https://www.vulncheck.com/advisories/express-gateway-through-1.16.11-hardcoded-default-cipherkey-exposes-oauth-tokens · [email protected]https://github.com/ExpressGateway/express-gateway/issues/1078 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 09 OCT 03:26Z
    EPSS moved — → 0%
    epss
  • 07 OCT 12:48Z
    Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens
    cvelistv5