---
id: CVE-2026-74880
title: >-
  openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query
  parameters in keyserver and telemetry server routes
summary: >-
  openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query
  parameters in keyserver and telemetry server routes. Attackers can extract
  tokens from server logs, proxy logs, browser history, and HTTP Referer headers
  to gain un…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-598
vendor: jahlives
product: openssl_encrypt
affected:
  - openssl_encrypt < 1.4.0
patched:
  - openssl_encrypt 1.4.0
published: '2026-08-17'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T16:17:40.000'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74880'
references:
  - url: >-
      https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-4rh7-jwg9-m28m
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/openssl-encrypt-before-token-leakage-via-query-parameters
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/jahlives/openssl_encrypt/commit/4b2adb05cde8a7ee03cdd271755da3b377c68011
  - url: 'https://github.com/jahlives/openssl_encrypt'
tags:
  - nvd
  - cve.org
  - osv
  - pip
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-08-17T14:39:23.317665Z'
epss: 0.00559
epssPercentile: 0.46393
aliases:
  - GHSA-4rh7-jwg9-m28m
ecosystem: pip
ingestedAt: '2026-08-18T12:28:08.238Z'
---

## Overview

openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.

## Affected

- `openssl_encrypt < 1.4.0`

## Remediation

Upgrade past the affected range:

- `openssl_encrypt 1.4.0`

## Package advisory (CVE-2026-74880)

Affected packages:

- `openssl-encrypt < 1.4.0`

Patched in:

- `openssl-encrypt 1.4.0`

Source: https://osv.dev/vulnerability/GHSA-4rh7-jwg9-m28m