CVE-2026-74880
Critical · 9.8CVSS
9.8
EPSS
0.6%
Published
Aug 17, 2026
CISA due date
—
The record
openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-113669 ApostropheCMS is an open-source Node.js content management system. CWE-598
- CVE-2026-61614 SolidInvoice is an open-source invoicing platform. CWE-598
- CVE-2026-82181 Medical Practice Management System developed by Le-yan has a Sensitive Data in URL… CWE-598
- CVE-2026-76179 An improper protection of authentication tokens vulnerability exists in certain Ebyte… CWE-598
- CVE-2026-63408 Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your… CWE-598
- CVE-2026-66832 When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the… CWE-598
- CVE-2026-14838 Use of GET request method with sensitive query strings vulnerability in Bilin Software… CWE-598
- CVE-2026-47768 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. CWE-598