CVE-2026-74880
Received Received - Intake

OpenSSL Encrypt Token Exposure via URL Query Parameters

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulnCheck

Description
openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-74880
EUVD
EUVD-2026-60099

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openssl openssl_encrypt to 1.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-598 The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects openssl_encrypt versions before 1.4.0. It allows refresh tokens to be passed as URL query parameters in keyserver and telemetry server routes. Attackers can then extract these tokens from server logs, proxy logs, browser history, or HTTP Referer headers to gain unauthorized access.

Detection Guidance

Check server access logs, proxy/CDN logs, and browser history for URLs containing refresh tokens in query parameters for keyserver or telemetry server routes. Look for GET requests with sensitive data in the URL.

Impact Analysis

If you use affected versions of openssl_encrypt, your refresh tokens could be exposed. Attackers may gain unauthorized access to systems or data protected by these tokens. The exposure can occur through logs, browser history, or network monitoring tools.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for protecting sensitive data. Compliance may be compromised due to potential token leakage and unauthorized access to protected information.

Mitigation Strategies

Upgrade openssl_encrypt to version 1.4.0 or later. Ensure refresh tokens are sent via POST requests in the body instead of GET query parameters. Review and remove any stored tokens in logs or browser history.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74880. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart