Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: ExpressGateway Clear all filters
TI-2026-69129 CVE-2026-107177 · GHSA-rq2q-fwh6-p47r

Express Gateway Hardcoded Default cipherKey Exposes OAuth Tokens

Priority HIGH 68

Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'.

CVSS 4.0HIGH 7.4 Network High privileges No interaction EPSS 0.00316 Published 2026-10-07 No fix listed CWE-1394
TI-2026-69125 CVE-2026-107162 · GHSA-p6v9-9m69-qjxm

Express Gateway OAuth refresh token grant authentication bypass

Priority HIGH 68

Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refresh_token grant that fails to validate the token secret or issuing client.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00363 Published 2026-10-07 No fix listed CWE-287