CVE-2026-74880

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-74880

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74880.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-74880

Aliases

GHSA-4rh7-jwg9-m28m

Published

2026-08-17T11:04:47.049Z

Modified

2026-08-19T03:45:23.543206524Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

openssl_encrypt before 1.4.0 Token Leakage via Query Parameters

Details

openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.

Database specific

{
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74880.json",
    "cwe_ids": [
        "CWE-598"
    ]
}

References

Affected packages

Git / github.com/jahlives/openssl_encrypt

Affected ranges

Type

GIT

Repo

https://github.com/jahlives/openssl_encrypt

Events

Introduced

Fixed

768df5cd1910e349509f07a27eeac6951e0003bf

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.4.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74880.json"