CVE-2026-107177: Use of Default Cryptographic Key in ExpressGateway express-gateway

CVE-2026-107177 identifies a hardcoded cryptographic key vulnerability in Express Gateway through version 1.16.11. The default crypto.cipherKey 'sensitiveKey' is embedded in the software, enabling attackers who have read access to the datastore (e.g., Redis) to decrypt OAuth 2.0 token secrets. This decryption allows the attacker to reconstruct valid bearer tokens by combining decrypted token secrets with stored token IDs, potentially granting unauthorized access to user accounts.

An attacker with datastore read access can decrypt OAuth 2.0 token secrets and generate valid bearer tokens for any user, leading to unauthorized access and potential compromise of user accounts and associated resources. This vulnerability compromises the confidentiality and integrity of authentication tokens stored by Express Gateway.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict datastore access to trusted entities only and monitor for unauthorized access attempts. Avoid using default or hardcoded cryptographic keys by configuring unique keys where possible.