Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-107177: Express Gateway may reveal OAuth tokens if Redis is read

CVE-2026-107177 · published 28 days ago

Summary

The Express Gateway version up to 1.16.11 uses a fixed encryption key for protecting OAuth token data. If an attacker can read the Redis store, they can decode those tokens and impersonate any user. Update to a newer version or configure a unique encryption key and restrict access to the Redis database.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
expressgateway	express-gateway	<= 1.16.11

Original advisory text

Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens

Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decrypt tokenEncrypted values and combine them with stored token IDs to obtain valid bearer tokens for any user.

References

https://www.vulncheck.com/advisories/express-gateway-through-1.16.11-hardcoded-d... Vendor Advisory
https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80... Third Party Advisory
https://github.com/ExpressGateway/express-gateway Product
https://github.com/ExpressGateway/express-gateway/issues/1078 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-1071... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-107177 Vendor Advisory
https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80... Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.1 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-1394Use of Default Cryptographic Key

Timeline

Published7 Oct 2026

Updated31 Oct 2026

First seen7 Oct 2026

Sources

CVE-2026-107177 · NVD

CVE-2026-107177 · MITRE

CVE-2026-107177 · OSV

Track software like this

Free during beta