Express Gateway
Monthly
OAuth 2.0 bearer token compromise in Express Gateway through 1.16.11 is possible when a deployment keeps the default crypto.cipherKey value 'sensitiveKey' and an attacker can read the Redis datastore. The attacker can decrypt stored tokenEncrypted values, combine them with stored token IDs, and obtain valid bearer tokens for any user, causing high confidentiality and integrity impact while availability remains unaffected. This is not remotely exploitable without preconditions: the assessed vector requires high privileges (PR:H), a present attack requirement (AT:P), and high complexity (AC:H), and no public exploit was identified at time of analysis; it is not confirmed actively exploited (CISA KEV).
Authentication bypass in Express Gateway through 1.16.11 (CWE-287) allows an attacker holding any valid registered OAuth 2.0 client credentials and the identifier portion of another user's refresh token to exchange it for that user's access token, impersonating the victim against OAuth2-protected APIs. The flaw is in the refresh_token grant handler, which never validates the refresh token's secret component or confirms that the presenting client is the client the token was issued to, producing high confidentiality and integrity impact with no availability impact (CVSS 4.0 base 7.6). Exploitation requires low-privileged access plus prior knowledge of the victim's token identifier (PR:L, AC:H), making this a targeted impersonation primitive rather than a mass-exploitable bug; no public exploit identified at time of analysis.
OAuth 2.0 bearer token compromise in Express Gateway through 1.16.11 is possible when a deployment keeps the default crypto.cipherKey value 'sensitiveKey' and an attacker can read the Redis datastore. The attacker can decrypt stored tokenEncrypted values, combine them with stored token IDs, and obtain valid bearer tokens for any user, causing high confidentiality and integrity impact while availability remains unaffected. This is not remotely exploitable without preconditions: the assessed vector requires high privileges (PR:H), a present attack requirement (AT:P), and high complexity (AC:H), and no public exploit was identified at time of analysis; it is not confirmed actively exploited (CISA KEV).
Authentication bypass in Express Gateway through 1.16.11 (CWE-287) allows an attacker holding any valid registered OAuth 2.0 client credentials and the identifier portion of another user's refresh token to exchange it for that user's access token, impersonating the victim against OAuth2-protected APIs. The flaw is in the refresh_token grant handler, which never validates the refresh token's secret component or confirms that the presenting client is the client the token was issued to, producing high confidentiality and integrity impact with no availability impact (CVSS 4.0 base 7.6). Exploitation requires low-privileged access plus prior knowledge of the victim's token identifier (PR:L, AC:H), making this a targeted impersonation primitive rather than a mass-exploitable bug; no public exploit identified at time of analysis.