Description
Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decrypt tokenEncrypted values and combine them with stored token IDs to obtain valid bearer tokens for any user.
Published: 2026-10-07
Score: 7.4 High
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 07 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Description Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decrypt tokenEncrypted values and combine them with stored token IDs to obtain valid bearer tokens for any user.
Title Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens
First Time appeared Express-gateway
Express-gateway express-gateway Docker Image
Weaknesses CWE-1394
CPEs cpe:2.3:a:express-gateway:express-gateway_docker_image:*:*:*:*:*:*:*:*
Vendors & Products Express-gateway
Express-gateway express-gateway Docker Image
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N'}

cvssV4_0

{'score': 7.4, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Express-gateway Express-gateway Docker Image
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-07T12:48:19.043Z

Reserved: 2026-10-07T12:40:26.059Z

Link: CVE-2026-107177

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-07T13:17:20.827

Modified: 2026-10-07T13:17:20.827

Link: CVE-2026-107177

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-1394

    Use of Default Cryptographic Key