CVE Catalog
CVE-2026-74880
CriticalCVSS 9.8Summary
openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.
Risk Assessment
The risk is that refresh tokens can be intercepted by an attacker, potentially leading to unauthorized access to user accounts and data.
Recommendation
Upgrade openssl_encrypt to version 1.4.0 or later to stop accepting tokens in URL parameters.
Original NVD description (English source)
openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.