The vulnerability CVE-2026-74880 affects jahlives' openssl_encrypt component prior to version 1.4.0. It involves the use of HTTP GET requests that include sensitive refresh tokens as URL query parameters in keyserver and telemetry server routes. Because these tokens appear in URLs, they can be inadvertently logged or exposed in various places such as server logs, proxy logs, browser history, and HTTP Referer headers. This exposure can be leveraged by attackers to gain unauthorized access to systems or data protected by these tokens. The CVSS 4.0 score is 9.3, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Attackers can obtain sensitive refresh tokens by intercepting or accessing logs and browser histories where these tokens are exposed in URL query strings. This exposure can lead to unauthorized access to protected resources or systems, compromising confidentiality, integrity, and availability of the affected services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using versions prior to 1.4.0 that accept sensitive tokens in URL query parameters. Consider redesigning the application to transmit sensitive tokens via POST requests or secure headers rather than in URLs to prevent token leakage through logs and browser history.