Description

openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-17T11:16:42.593Z",
  "pubdate": "2026-08-17T11:16:42.593Z",
  "executiveSummary": "A sensitive information disclosure vulnerability exists in openssl_encrypt versions before 1.4.0, specifically affecting keyserver and telemetry server routes.\nThe vulnerability arises from the application design accepting refresh tokens as URL query parameters rather than securely within HTTP headers or the request body.\nThis improper handling allows malicious actors or unintended observers to capture authentication tokens from multiple sources, including server logs, intermediary proxy logs, browser history, and HTTP Referer headers.\nSuccessful exploitation grants unauthorized access to restricted resources and systems managed by the affected keyserver and telemetry routes.\nAttackers do not require complex exploitation techniques; passive observation of network traffic or log files is sufficient to harvest valid refresh tokens.\nThe resulting risk profile is critical, as compromised refresh tokens provide prolonged unauthorized authentication sessions, bypassing standard perimeter security controls in affected openssl_encrypt deployments.",
  "technicalDetails": "The root cause of this vulnerability is the insecure transmission mechanism utilized by keyserver and telemetry server routes in openssl_encrypt versions before 1.4.0.\nInstead of transmitting sensitive authentication material such as refresh tokens via encrypted HTTP POST request bodies or specialized authorization headers, the application processes these tokens directly within the URL query string.\nQuery parameters are inherently persistent and widely intercepted across standard web infrastructure.\nWhen a user or client application interacts with the vulnerable keyserver or telemetry server routes, the refresh token is appended to the Uniform Resource Identifier (URI).\nThis design flaw leads to widespread token leakage through several distinct channels.\nFirst, web server access logs and telemetry server logging infrastructure record full incoming request URLs, thereby storing plaintext refresh tokens on disk.\nSecond, intermediate HTTP proxy servers and reverse proxies log complete request URIs for debugging and auditing purposes.\nThird, client-side browser history retains the exact URLs visited, exposing the tokens to local users or malicious scripts with profile access.\nFourth, when users navigate from vulnerable keyserver or telemetry routes to external domains, the full URL—including the refresh token query parameter—is transmitted via the HTTP Referer header, exposing the secret to third-party web analytics and external site administrators.\nAn attacker leverages this exposure by accessing compromised log files, monitoring network traffic logs, inspecting browser histories, or analyzing HTTP Referer logs.\nOnce the plaintext refresh token is extracted, the attacker replays or submits the token to the keyserver or telemetry server routes.\nBecause the server accepts the token via query parameters and treats it as valid authentication, the attacker successfully impersonates the legitimate user or client.\nThis grants the attacker unauthorized access to protected functionalities and sensitive data handled by the affected openssl_encrypt components without requiring prior authentication or elevated privileges."
}