Vulnerability · Published Oct 7, 2026 · Assigned by VulnCheck

CVE-2026-107162Express Gateway through 1.16.11 OAuth 2.0 Refresh Token Validation Bypass

Medium 6.8

In plain English

A medium-severity improper authentication in express-gateway from ExpressGateway. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.4%top 69.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refresh_token grant that fails to validate the token secret or issuing client. Attackers with any valid client credentials and the identifier portion of another user's refresh token can obtain that user's access token and impersonate them against oauth2-protected APIs.

Affected products (as reported)

Vendor	Product	Versions
ExpressGateway	express-gateway	0 – through 1.16.11

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

References

GitHub Issue #1076 issue-tracking
https://github.com/ExpressGateway/express-gateway product
https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/policies/oauth2/oauth2-server.js#L221-L247 technical-description
https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/services/tokens/token.service.js#L100-L136 technical-description
VulnCheck Advisory: Express Gateway through 1.16.11 OAuth 2.0 Refresh Token Validation Bypass third-party-advisory