| Package | Affected versions | Patched versions |
|---|---|---|
| openssl-encrypt | < 1.4.0 | 1.4.0 |
| openssl encrypt | < 1.4.0 | 1.4.0 |
Refresh tokens are accepted as URL query parameters in the keyserver and telemetry server routes.
# openssl_encrypt_server/modules/keyserver/routes.py:214-215
# openssl_encrypt_server/modules/telemetry/routes.py:90-91
async def refresh_token(
request: Request,
refresh_token: str = Query(..., description="Refresh token")
):
Tokens in URL query parameters are exposed in:
This creates significant token leakage risk.
Body(...) instead of Query(...)Fixed in commit 4b2adb0 on branch releases/1.4.x — moved refresh token from Query parameter to POST body via RefreshRequest Pydantic model.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free