CVE-2026-107162: Express Gateway through 1.16.11 OAuth 2.0 Refresh Token Validation Bypass
Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refreshtoken grant that fails to validate the token secret or issuing client. Attackers with any valid client credentials and the identifier portion of another user's refresh token can obtain that user's access token and impersonate them against oauth2-protected APIs.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Express Gateway releases through 1.16.11 are affected where the OAuth 2.0 refresh_token grant is used.
Does an attacker need the victim's client credentials or full refresh token?
No. The attacker needs any valid client credentials plus the identifier portion of another user's refresh token; the vulnerable flow does not validate the token secret or issuing client.
What can an attacker do after exploiting the issue?
They can obtain the targeted user's access token and impersonate that user against OAuth 2.0-protected APIs.