CVE-2026-107162

MediumCVSS 6.8

Published: 07/10/2026(UTC)Updated: 10/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

19th percentile - higher than 19% of all known CVEs

Summary

Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refresh_token grant that fails to validate the token secret or issuing client. Attackers with any valid client credentials and the identifier portion of another user's refresh token can obtain that user's access token and impersonate them against oauth2-protected APIs.

Risk Assessment

Potential account takeover and unauthorized access to protected APIs, potentially leading to data breaches and system integrity issues.

Recommendation

Update Express Gateway to a patched version or implement additional validation mechanisms for refresh tokens.

Other vulnerabilities in Express Gateway

CVE-2026-107177Medium
Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decrypt tokenEncrypted values and combine them with stored token IDs to obtain valid bearer tokens for any user.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS