CVE-2026-107177: Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-07 · updated 2026-10-07
Weakness: CWE-1394

Description

Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decrypt tokenEncrypted values and combine them with stored token IDs to obtain valid bearer tokens for any user.

Affected products

ExpressGateway express-gateway: through 1.16.11

References

https://github.com/ExpressGateway/express-gateway
https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/config/system.config.yml#L15-L22
https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/services/utils.js#L18-L28
https://github.com/ExpressGateway/express-gateway/issues/1078
https://www.vulncheck.com/advisories/express-gateway-through-1.16.11-hardcoded-default-cipherkey-exposes-oauth-tokens
https://github.com/ExpressGateway/express-gateway/issues/1078

Get alerted when CVE-2026-107177 or the next vulnerability affects your stack