MinorCritical vulnerability

CVE-2026-107177 (CVSS 7.4)

NVD · officialPublished Oct 7, 2026Risk 23/100

Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decrypt tokenEncrypted values and combine them with stored token IDs to obtain valid bearer tokens for any user.

Technical details

CVSS

7.4

AV:NetworkAC:HighPR:HighUI:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source