GHSA-4rh7-jwg9-m28m
openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage
Quick fix
GHSA-4rh7-jwg9-m28m — openssl-encrypt: upgrade to the fixed version with the command below.
pip install --upgrade 'openssl-encrypt>=1.4.0'Details
### Summary
Refresh tokens are accepted as URL query parameters in the keyserver and telemetry server routes.
### Affected Code
```python # openssl_encrypt_server/modules/keyserver/routes.py:214-215 # openssl_encrypt_server/modules/telemetry/routes.py:90-91 async def refresh_token( request: Request, refresh_token: str = Query(..., description="Refresh token") ): ```
### Impact
Tokens in URL query parameters are exposed in: - Server access logs - Proxy/CDN logs - Browser history - HTTP Referer headers - Network monitoring tools
This creates significant token leakage risk.
### Recommended Fix
- Accept refresh tokens in the request body (POST) instead of query parameters - Use `Body(...)` instead of `Query(...)`
### Fix
Fixed in commit `4b2adb0` on branch `releases/1.4.x` — moved refresh token from Query parameter to POST body via RefreshRequest Pydantic model.
Are you affected?
Enter the version of the package you're using.
Affected packages
0 Fixed in: 1.4.0 pip install --upgrade 'openssl-encrypt>=1.4.0'