{"id":"CVE-2026-74880","aliases":["GHSA-4rh7-jwg9-m28m"],"title":"openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage","summary":"openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage","severity":"medium","vendor":"openssl-encrypt","product":"openssl-encrypt","ecosystem":"pip","affected":["openssl-encrypt < 1.4.0"],"patched":["openssl-encrypt 1.4.0"],"published":"2026-04-01","updated":"2026-08-18","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-4rh7-jwg9-m28m","references":[{"url":"https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-4rh7-jwg9-m28m"},{"url":"https://github.com/jahlives/openssl_encrypt/commit/4b2adb05cde8a7ee03cdd271755da3b377c68011"},{"url":"https://github.com/jahlives/openssl_encrypt"}],"tags":["osv","pip"],"ingestedAt":"2026-08-18T12:28:08.238Z","epss":0.00307,"epssPercentile":0.23753,"slug":"CVE-2026-74880","body":"## Overview\n\n### Summary\n\nRefresh tokens are accepted as URL query parameters in the keyserver and telemetry server routes.\n\n### Affected Code\n\n```python\n# openssl_encrypt_server/modules/keyserver/routes.py:214-215\n# openssl_encrypt_server/modules/telemetry/routes.py:90-91\nasync def refresh_token(\n    request: Request,\n    refresh_token: str = Query(..., description=\"Refresh token\")\n):\n```\n\n### Impact\n\nTokens in URL query parameters are exposed in:\n- Server access logs\n- Proxy/CDN logs\n- Browser history\n- HTTP Referer headers\n- Network monitoring tools\n\nThis creates significant token leakage risk.\n\n### Recommended Fix\n\n- Accept refresh tokens in the request body (POST) instead of query parameters\n- Use `Body(...)` instead of `Query(...)`\n\n### Fix\n\nFixed in commit `4b2adb0` on branch `releases/1.4.x` — moved refresh token from Query parameter to POST body via RefreshRequest Pydantic model.\n\n## Affected packages\n\n- `openssl-encrypt < 1.4.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `openssl-encrypt 1.4.0`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}