CVE-2026-107162: Improper Authentication in ExpressGateway express-gateway

CVE-2026-107162 describes an authentication bypass vulnerability in Express Gateway through version 1.16.11. The flaw exists in the OAuth 2.0 refresh_token grant implementation, where the validation of the token secret or issuing client is missing or insufficient. This allows an attacker possessing any valid client credentials and the identifier portion of another user's refresh token to generate that user's access token, effectively impersonating the user to access OAuth2-protected resources.

Successful exploitation allows an attacker with limited privileges (valid client credentials) to impersonate other users by obtaining their access tokens without proper authentication. This can lead to unauthorized access to protected APIs and potentially sensitive data exposure. The CVSS 4.0 base score is 7.6 (high severity), reflecting network attack vector, high complexity, partial attack prerequisites, and high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to client credentials and monitor for suspicious use of refresh tokens. Avoid sharing refresh token identifiers and consider additional validation layers if possible.