{"id":"CVE-2026-74880","aliases":["GHSA-4rh7-jwg9-m28m","PYSEC-2026-3759"],"url":"https://o3.security/vulnerability/CVE-2026-74880","summary":"openssl_encrypt before 1.4.0 Token Leakage via Query Parameters","details":"### Summary\n\nRefresh tokens are accepted as URL query parameters in the keyserver and telemetry server routes.\n\n### Affected Code\n\n```python\n# openssl_encrypt_server/modules/keyserver/routes.py:214-215\n# openssl_encrypt_server/modules/telemetry/routes.py:90-91\nasync def refresh_token(\n    request: Request,\n    refresh_token: str = Query(..., description=\"Refresh token\")\n):\n```\n\n### Impact\n\nTokens in URL query parameters are exposed in:\n- Server access logs\n- Proxy/CDN logs\n- Browser history\n- HTTP Referer headers\n- Network monitoring tools\n\nThis creates significant token leakage risk.\n\n### Recommended Fix\n\n- Accept refresh tokens in the request body (POST) instead of query parameters\n- Use `Body(...)` instead of `Query(...)`\n\n### Fix\n\nFixed in commit `4b2adb0` on branch `releases/1.4.x` — moved refresh token from Query parameter to POST body via RefreshRequest Pydantic model.","published":"2026-08-17T11:04:47.049Z","modified":"2026-10-28T02:31:02.511110119Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"openssl-encrypt","fixedVersion":"1.4.0"}],"fix":{"url":"https://github.com/jahlives/openssl_encrypt/commit/4b2adb05cde8a7ee03cdd271755da3b377c68011","label":"jahlives/openssl_encrypt@4b2adb0"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74880.json"},{"type":"ADVISORY","url":"https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-4rh7-jwg9-m28m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74880"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/openssl-encrypt-before-token-leakage-via-query-parameters"},{"type":"WEB","url":"https://github.com/jahlives/openssl_encrypt/commit/4b2adb05cde8a7ee03cdd271755da3b377c68011"},{"type":"PACKAGE","url":"https://github.com/jahlives/openssl_encrypt"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:02.511110119Z"}}