EUVD-2026-60099
GHSA-j2j2-c4gj-7cmc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitation depends on obtaining a leaked token from logs/history/Referer rather than a direct request, so AC:H; a captured refresh token yields account access (C:H) with limited integrity impact and no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.
AnalysisAI
Sensitive-token exposure in openssl_encrypt (the jahlives Python package, pip 'openssl-encrypt') before 1.4.0 stems from the keyserver and telemetry server accepting refresh tokens as GET query parameters. Because URLs are routinely written to server access logs, proxy/CDN logs, browser history, and forwarded in HTTP Referer headers, any party with access to those artifacts can harvest a valid refresh token and mint new access tokens, effectively bypassing authentication. Reported by VulnCheck; no public exploit identified at time of analysis and it is not on CISA KEV.
Technical ContextAI
openssl_encrypt ships a server component (openssl_encrypt_server) built on a FastAPI/Starlette-style framework. The vulnerable routes (keyserver/routes.py lines 214-215 and telemetry/routes.py lines 90-91) declare the refresh_token as a FastAPI Query(...) parameter, so the secret travels in the URL query string of a GET request. This is a textbook CWE-598 (Use of GET Request Method With Sensitive Query Strings) issue: query strings are considered non-sensitive by the surrounding infrastructure and are logged, cached, and propagated by design. The remediation moves the token into a POST body via a RefreshRequest Pydantic model using Body(...), keeping the secret out of URLs.
RemediationAI
Upgrade to openssl_encrypt 1.4.0, which contains the fix (Vendor-released patch: 1.4.0; upstream commit 4b2adb05cde8a7ee03cdd271755da3b377c68011 on branch releases/1.4.x) that moves the refresh token from a query parameter into the POST request body. If you cannot upgrade immediately, apply compensating controls: reconfigure the keyserver/telemetry front-end proxy to stop logging query strings (e.g., strip the query component in access-log format) so tokens are not written to disk, and add a proxy rule to reject or rewrite requests carrying refresh_token in the URL; restrict network access to the keyserver and telemetry routes to trusted clients only; and rotate/invalidate any refresh tokens that may already have been logged, since existing tokens remain valid and leaked. Note the trade-off that suppressing query-string logging reduces forensic/audit visibility, and access restrictions may break integrations that legitimately call these routes. See GHSA-4rh7-jwg9-m28m for vendor guidance.
More in Openssl Encrypt
View allArbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from i
Fingerprint-verification spoofing in jahlives openssl_encrypt before 1.4.9 lets attackers embed ANSI escape sequences in
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run wit
Arbitrary code execution in jahlives openssl_encrypt before 1.4.0 stems from an inconsistent sandbox: the runtime Plugin
Authentication bypass in the jahlives openssl_encrypt library (all versions before 1.4.0) lets remote unauthenticated at
Authentication brute-force protection can be bypassed in jahlives openssl_encrypt before 1.4.0 because the TOTP rate lim
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break ou
Cryptographic shared-secret disclosure in the openssl_encrypt Python library (maintainer 'jahlives') before 1.4.0 lets a
Sandbox escape leading to remote code execution affects openssl_encrypt (the jahlives Python package) in all versions be
Arbitrary code execution in openssl_encrypt (the jahlives Python encryption utility) before 1.4.9 allows an attacker-sup
Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a den
Arbitrary command execution in jahlives' openssl_encrypt before 1.4.9 arises when the tool's 'info' command reconstructs
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today