CVE-2026-74880: openssl_encrypt before 1.4.0 Token Leakage via Query Parameters
opensslencrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.0 - Compensating control
Prevent refresh tokens from being placed in URL query parameters for the keyserver and telemetry server routes; ensure refresh tokens are not written to server/proxy logs, browser history, or HTTP Referer headers.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74880?
The severity of CVE-2026-74880 is critical with a score of 9.8.
How do I fix CVE-2026-74880?
To fix CVE-2026-74880, upgrade to OpenSSL Encrypt version 1.4.0 or later.
What type of vulnerability is CVE-2026-74880?
CVE-2026-74880 is a token leakage vulnerability due to mishandling of query parameters in OpenSSL Encrypt.
What effect does CVE-2026-74880 have on security?
CVE-2026-74880 allows attackers to extract sensitive refresh tokens, potentially leading to unauthorized access.
In which versions of OpenSSL is CVE-2026-74880 present?
CVE-2026-74880 is present in OpenSSL Encrypt versions before 1.4.0.