openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage
Summary
Refresh tokens are accepted as URL query parameters in the keyserver and telemetry server routes.
Affected Code
# openssl_encrypt_server/modules/keyserver/routes.py:214-215
# openssl_encrypt_server/modules/telemetry/routes.py:90-91
async def refresh_token(
request: Request,
refresh_token: str = Query(..., description="Refresh token")
):Impact
Tokens in URL query parameters are exposed in:
- Server access logs
- Proxy/CDN logs
- Browser history
- HTTP Referer headers
- Network monitoring tools
This creates significant token leakage risk.
Recommended Fix
- Accept refresh tokens in the request body (POST) instead of query parameters
- Use
Body(...)instead ofQuery(...)
Fix
Fixed in commit 4b2adb0 on branch releases/1.4.x — moved refresh token from Query parameter to POST body via RefreshRequest Pydantic model.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | openssl-encrypt | < 1.4.0 | 1.4.0 |
References
- https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-4rh7-jwg9-m28m
- https://www.vulncheck.com/advisories/openssl-encrypt-before-token-leakage-via-query-parameters
- https://github.com/jahlives/openssl_encrypt/commit/4b2adb05cde8a7ee03cdd271755da3b377c68011
- https://github.com/jahlives/openssl_encrypt
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U- Weakness (CWE)
CWE-598- Platform
- Python (PyPI)
- Package
openssl-encrypt- Disclosed
- 01.04.2026
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-3759 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-4rh7-jwg9-m28m - CC BY 4.0
Vulnerability history: openssl-encrypt
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 60
- First → latest
- 03.2026 08.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 1
- Medium 15
- Unrated 42
Disclosures per year
- 2026: 60
-
openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.