CVE-2026-107162

MediumCVSS 6.8/10Last modified Oct 10, 2026

Description

Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refresh_token grant that fails to validate the token secret or issuing client. Attackers with any valid client credentials and the identifier portion of another user's refresh token can obtain that user's access token and impersonate them against oauth2-protected APIs.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 7, 2026
Last modified: Oct 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1071665.3A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogs_pfcp_xact_local_create of the file src/up CVE-2026-1071676.2A flaw was found in m17n-lib. A user providing specially crafted text input can trigger a heap use-after-free condition during input-method CVE-2026-1071686.2A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can cause the text pars CVE-2026-1071696.2A flaw was found in m17n-lib. An attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dere CVE-2026-107171.8Out of bounds write and reads in openSeaChest’s --showSCSIDefects in Seagate’s openSeaChest v25.05.3 on all supported platforms allows for w CVE-2026-1071702.9A flaw was found in m17n-lib. A partial failure during library initialization can leave an internal driver pointer uninitialized. Under spec CVE-2026-1071716.9An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users.CVE-2026-1071746.4A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to abs CVE-2026-1071755.3MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distr CVE-2026-1071766.8A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, an CVE-2026-1071775.9Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt CVE-2026-1071786.8The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printin