Vulnerability · Published Aug 17, 2026 · Assigned by VulnCheck
CVE-2026-74880openssl_encrypt before 1.4.0 Token Leakage via Query Parameters
Critical 9.8
In plain English
A critical-severity security flaw in openssl_encrypt from jahlives. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.6%top 53.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | openssl-encrypt | 1.4.0 | GHSA-4rh7-jwg9-m28m |
| PyPI | openssl-encrypt | 1.4.0 | PYSEC-2026-3759 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| jahlives | openssl_encrypt | 0 – before 1.4.0 |
Weakness: CWE-598 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-4rh7-jwg9-m28m) vendor-advisory
- VulnCheck Advisory: openssl_encrypt before 1.4.0 Token Leakage via Query Parameters third-party-advisory