EUVD-2026-94317
GHSA-rq2q-fwh6-p47r
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires privileged read access to the Redis datastore (PR:H) plus the non-default-key condition and token-reassembly effort (AC:H); token forgery breaks confidentiality and integrity (C:H/I:H) with no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decrypt tokenEncrypted values and combine them with stored token IDs to obtain valid bearer tokens for any user.
AnalysisAI
OAuth 2.0 bearer token compromise in Express Gateway through 1.16.11 is possible when a deployment keeps the default crypto.cipherKey value 'sensitiveKey' and an attacker can read the Redis datastore. The attacker can decrypt stored tokenEncrypted values, combine them with stored token IDs, and obtain valid bearer tokens for any user, causing high confidentiality and integrity impact while availability remains unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two concrete prerequisites must both hold: (1) the attacker must have read access to the Redis datastore backing Express Gateway (tokenEncrypted values and token IDs are stored there), and (2) the deployment must still use the default crypto.cipherKey value 'sensitiveKey' as shipped in lib/config/system.config.yml. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N, base 7.4) already encodes a high bar for exploitation: the attacker needs high privileges (PR:H), the attack carries a present requirement (AT:P), and complexity is high (AC:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified in the provided sources at time of analysis, so prioritize compensating controls. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Express Gateway instance running version 1.16.11 or earlier and verify whether the default crypto.cipherKey value 'sensitiveKey' remains in use; simultaneously restrict network access to the associated Redis datastore so that only the gateway can reach it. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Authenticated remote code execution in OpenC3 COSMOS (Ruby gem 'openc3' versions 5.1.0 through 7.2.1) lets any logged-in
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
RESP protocol command injection in Predis, the popular PHP client for Redis and Valkey, affects versions 3.0.0-RC1 throu
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab
An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability
Same weakness CWE-1394 – Use of Default Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today