CVE-2026-107177
Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens
- State
- Published
- Severity
- 7.4 High
- Published
- Oct 7, 2026
- Updated
- Oct 7, 2026
- Reserved
- Oct 7, 2026
Description
Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decrypt tokenEncrypted values and combine them with stored token IDs to obtain valid bearer tokens for any user.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.4 High | CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.9 Medium | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-1394 Use of Default Cryptographic Key
Affected Products
| Product | Versions |
|---|---|
express-gatewayExpressGateway |
|
References
- GitHub Issue #1078issue-tracking
- https://github.com/ExpressGateway/express-gatewayproduct
- https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/config/system.config.yml#L15-L22technical-description
- https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/services/utils.js#L18-L28technical-description
- VulnCheck Advisory: Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokensthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.