Refresh Tokens Exposed in URL Query Parameters

CVE-2026-74880 is a critical vulnerability in openssl_encrypt versions before 1.4.0 that exposes sensitive refresh tokens through URL query parameters on keyserver and telemetry server routes. This design flaw allows attackers to harvest authentication credentials from multiple sources: server access logs, proxy logs, browser history, and HTTP Referer headers—all locations where URLs are routinely stored and transmitted. Organizations using affected versions face immediate risk of unauthorized access, token hijacking, and lateral movement. The vulnerability affects any deployment relying on openssl_encrypt for authentication token handling, making it a widespread threat across cloud infrastructure, API gateways, and identity management systems.

While this CVE shows zero matching skills in Casky's current 754-skill framework (indicating a gap in existing detections), practitioners using Casky's Claude AI with extended reasoning capabilities would identify attack patterns aligned with MITRE ATT&CK's credential access techniques. Security teams should look for suspicious behaviors including: unusual token reuse across different IP addresses or geographic locations, tokens appearing in access logs with abnormal query string patterns, and spike in failed authentication attempts followed by successful ones using harvested tokens. Organizations should immediately audit logs for token exposure, upgrade to openssl_encrypt 1.4.0+, implement token parameter binding to prevent replay attacks, and transition to secure HTTP-only, SameSite-restricted cookie-based token handling to eliminate query parameter token transmission entirely.