CVE-2026-74880

Katalog CVE

CVSS 9.8 · Critical EPSS 0,56%

Kerentanan Use of HTTP Request With Sensitive Query String pada jahlives openssl encrypt. Skor CVSS 3.1 9.8 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.

Advisory KUTIM-CSIRT

• Peringatan Keamanan: Rekapitulasi 66 Kerentanan pada Paket Python openssl_encrypt 5 Sep 2026

Rincian

Terbit di NVD

17 Agustus 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-598: Use of HTTP Request With Sensitive Query String

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 45,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-4rh7-jwg9-m28m mitigasi · advisory vendor
• https://www.vulncheck.com/advisories/openssl-encrypt-before-token-leakage-via-query-parameters advisory pihak ketiga