---
id: CVE-2026-74880
aliases:
  - GHSA-4rh7-jwg9-m28m
title: >-
  openssl-encrypt accepts refresh tokens as URL query parameters causing token
  leakage
summary: >-
  openssl-encrypt accepts refresh tokens as URL query parameters causing token
  leakage
severity: medium
vendor: openssl-encrypt
product: openssl-encrypt
ecosystem: pip
affected:
  - openssl-encrypt < 1.4.0
patched:
  - openssl-encrypt 1.4.0
published: '2026-04-01'
updated: '2026-08-18'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-4rh7-jwg9-m28m'
references:
  - url: >-
      https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-4rh7-jwg9-m28m
  - url: >-
      https://github.com/jahlives/openssl_encrypt/commit/4b2adb05cde8a7ee03cdd271755da3b377c68011
  - url: 'https://github.com/jahlives/openssl_encrypt'
tags:
  - osv
  - pip
ingestedAt: '2026-08-18T12:28:08.238Z'
epss: 0.00559
epssPercentile: 0.44231
---

## Overview

### Summary

Refresh tokens are accepted as URL query parameters in the keyserver and telemetry server routes.

### Affected Code

```python
# openssl_encrypt_server/modules/keyserver/routes.py:214-215
# openssl_encrypt_server/modules/telemetry/routes.py:90-91
async def refresh_token(
    request: Request,
    refresh_token: str = Query(..., description="Refresh token")
):
```

### Impact

Tokens in URL query parameters are exposed in:
- Server access logs
- Proxy/CDN logs
- Browser history
- HTTP Referer headers
- Network monitoring tools

This creates significant token leakage risk.

### Recommended Fix

- Accept refresh tokens in the request body (POST) instead of query parameters
- Use `Body(...)` instead of `Query(...)`

### Fix

Fixed in commit `4b2adb0` on branch `releases/1.4.x` — moved refresh token from Query parameter to POST body via RefreshRequest Pydantic model.

## Affected packages

- `openssl-encrypt < 1.4.0`

## Remediation

Upgrade to a patched release:

- `openssl-encrypt 1.4.0`