CVE-2026-107162: Express Gateway through 1.16.11 OAuth 2.0 Refresh Token Validation Bypass

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-07 · updated 2026-10-10
Weakness: CWE-287

Description

Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refresh_token grant that fails to validate the token secret or issuing client. Attackers with any valid client credentials and the identifier portion of another user's refresh token can obtain that user's access token and impersonate them against oauth2-protected APIs.

Affected products

ExpressGateway express-gateway: through 1.16.11

References

https://github.com/ExpressGateway/express-gateway
https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/policies/oauth2/oauth2-server.js#L221-L247
https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/services/tokens/token.service.js#L100-L136
https://github.com/ExpressGateway/express-gateway/issues/1076
https://www.vulncheck.com/advisories/express-gateway-through-1.16.11-oauth-2.0-refresh-token-validation-bypass
https://github.com/ExpressGateway/express-gateway/issues/1076

Get alerted when CVE-2026-107162 or the next vulnerability affects your stack