CVE-2026-74880 — openssl_encrypt before 1.4.0 Token Leakage via Query Parameters

Affected: jahlives openssl_encrypt

openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.

GHSA-4rh7-jwg9-m28m — openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage

Affected: PyPI: openssl-encrypt

### Summary

Refresh tokens are accepted as URL query parameters in the keyserver and telemetry server routes.

### Affected Code

```python # openssl_encrypt_server/modules/keyserver/routes.py:214-215 # openssl_encrypt_server/modules/telemetry/routes.py:90-91 async def refresh_token( request: Request, refresh_token: str = Query(..., description="Refresh token") ): ```

### Impact

Tokens in URL query parameters are exposed in: - Server access logs - Proxy/CDN logs - Browser history - HTTP Referer headers - Network monitoring tools

This creates significant token leakage risk.

### Recommended Fix

- Accept refresh tokens in the request body (POST) instead of query parameters - Use `Body(...)` instead of `Query(...)`

### Fix

Fixed in commit `4b2adb0` on branch `releases/1.4.x` — moved refresh token from Query parameter to POST body via RefreshRequest Pydantic model.

Most recent entries from all

CVE-2026-74880 — openssl_encrypt before 1.4.0 Token Leakage via Query Parameters

GHSA-4rh7-jwg9-m28m — openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage