CVE-2026-107177— Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens
Quick assessment
Affected
ExpressGateway express-gateway
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Express Gateway 在 1.16.11 及更早版本中存在一个硬编码加密密钥漏洞。攻击者若具备对数据存储的访问权限，便可通过默认配置的 敏感密钥 解密已存储的 OAuth 2.0 Token 密钥。能够读取 Redis 数据的攻击者可以解密 值，并结合已存储的 Token ID，从而获取任意用户的合法 Bearer Token。
Possible ATT&CK Techniques 1 AI
T1552.004 · Private Keys
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107177
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens
Source: CVE Program / CVE List V5
Vulnerability Description
Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decrypt tokenEncrypted values and combine them with stored token IDs to obtain valid bearer tokens for any user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1394
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ExpressGateway | express-gateway | 0 ~ 1.16.11 | - |
|
II. Public POCs for CVE-2026-107177
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107177
请登录查看更多情报信息。
Other References for CVE-2026-107177 (5)
IV. Related Vulnerabilities
Same weakness: CWE-1394
-
CVE-2026-75870
Punk versions before 0.18 for Perl allow session cookie forg -
CVE-2026-54887
DTLS server cookie bypass during startup window due to empty -
CVE-2026-5039
Predictable Default Cryptographic Key Used for DES Encryptio -
CVE-2026-2215
rachelos WeRSS we-mp-rss JWT auth.py default key -
CVE-2026-25815
Fortinet FortiOS 安全漏洞
V. Comments for CVE-2026-107177
No comments yet