CVE-2026-74880

creationtimestamp| type| source ---|---|--- 2026-08-17 12:08:20+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtbo5ecwnl2p 2026-08-17 18:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtcdhz5ina25 2026-08-18 04:50:04+00:00| seen|...

CVE-2026-74880

opensslencrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access...

CVE-2026-74880

The openssl_encrypt package (before 1.4.0) accepts refresh tokens as URL query parameters in its keyserver and telemetry server routes. Because URLs are logged in server logs, proxy logs, browser history, and HTTP Referer headers, attackers can extract these tokens to gain unauthorized access. Th...

CVE-2026-74880 openssl_encrypt before 1.4.0 Token Leakage via Query Parameters

opensslencrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access...