EUVD-2026-94316
GHSA-p6v9-9m69-qjxm
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but AC:H because the attacker must know the victim's refresh-token identifier, and PR:L because any valid client credentials are required; impersonation yields C:H/I:H with no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refresh_token grant that fails to validate the token secret or issuing client. Attackers with any valid client credentials and the identifier portion of another user's refresh token can obtain that user's access token and impersonate them against oauth2-protected APIs.
AnalysisAI
Authentication bypass in Express Gateway through 1.16.11 (CWE-287) allows an attacker holding any valid registered OAuth 2.0 client credentials and the identifier portion of another user's refresh token to exchange it for that user's access token, impersonating the victim against OAuth2-protected APIs. The flaw is in the refresh_token grant handler, which never validates the refresh token's secret component or confirms that the presenting client is the client the token was issued to, producing high confidentiality and integrity impact with no availability impact (CVSS 4.0 base 7.6). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an Express Gateway instance (≤1.16.11) with the OAuth 2.0 policy enabled and the refresh_token grant type in use. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS 4.0 base score is 7.6 (High) with vector AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N, indicating a network-reachable authentication bypass with high confidentiality and integrity impact but no availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis; the public references are the project repository, a code-location pointer, and issue 1076 rather than a tagged fixed release, so verify with the maintainers whether a remediation has since been published and treat 1.16.11 as the last known-affected version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Express Gateway instances and confirm whether any are running version 1.16.11 or earlier; restrict OAuth 2.0 client registration and credentials to trusted, least-privileged applications; rotate refresh tokens for sensitive accounts; and review gateway and identity logs for refresh_token grant exchanges where the presenting client does not match the token's issued client. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Express Gateway
View allSame weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today