CVE-2026-107177
5.9 MEDIUMpublic exploit availablePublished 2026-10-07 · Updated 2026-10-07
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decrypt tokenEncrypted values and combine them with stored token IDs to obtain valid bearer tokens for any user.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-1394
Public exploit & PoC references
- https://github.com/ExpressGateway/express-gateway
- https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/config/system.config.yml#L15-L22
- https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/services/utils.js#L18-L28
- https://github.com/ExpressGateway/express-gateway/issues/1078
- https://github.com/ExpressGateway/express-gateway/issues/1078
All references
- https://github.com/ExpressGateway/express-gateway
- https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/config/system.config.yml#L15-L22
- https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/services/utils.js#L18-L28
- https://github.com/ExpressGateway/express-gateway/issues/1078
- https://www.vulncheck.com/advisories/express-gateway-through-1.16.11-hardcoded-default-cipherkey-exposes-oauth-tokens
- https://github.com/ExpressGateway/express-gateway/issues/1078
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
Related by shared AI tags and CWE weakness class. Browse the full archive.