GHSA-4rh7-jwg9-m28m: openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage

April 1, 2026

Refresh tokens are accepted as URL query parameters in the keyserver and telemetry server routes.

References

github.com/advisories/GHSA-4rh7-jwg9-m28m
github.com/jahlives/openssl_encrypt
github.com/jahlives/openssl_encrypt/commit/4b2adb05cde8a7ee03cdd271755da3b377c68011
github.com/jahlives/openssl_encrypt/security/advisories/GHSA-4rh7-jwg9-m28m

Code Behaviors & Features

Detect and mitigate GHSA-4rh7-jwg9-m28m with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →