CVE-2026-74880CWE-598

CVE-2026-74880

Critical · published August 17, 2026

CVSS v3.1

9.8

EPSS

Percentile

45.8

In the wild

Unconfirmed

What it is

openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.

The record

Technical detail

CVSS v3.1: 9.8 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: 9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00559 · 45.8th percentile
Weakness: CWE-598 · Use of HTTP Request With Sensitive Query String
Published: 2026-08-17T15:16Z

Affected products (1)

Product	Versions	Fixed in
jahlives/openssl_encrypt	< 1.4.0	1.4.0

References (2)

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-4rh7-jwg9-m28m · [email protected]https://www.vulncheck.com/advisories/openssl-encrypt-before-token-leakage-via-query-parameters · [email protected]

EPSS history

Timeline

17 AUG 11:04Z
openssl_encrypt before 1.4.0 Token Leakage via Query Parameters
cvelistv5