CVE-2026-107177

{
  "etk_id": "ETK-2026-874",
  "cve_id": "CVE-2026-107177",
  "display_id": "CVE-2026-107177",
  "ghsa_id": "GHSA-rq2q-fwh6-p47r",
  "euvd_id": "EUVD-2026-94317",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Hardcoded cryptographic key in Express Gateway",
  "summary": "Express Gateway through 1.16.11 uses a known default key for encrypting stored OAuth token secrets. An attacker with datastore read access, including Redis access, may decrypt those secrets and use stored token identifiers to obtain bearer tokens for users.",
  "mitigation": "Replace the default `crypto.cipherKey` with a unique protected value, restrict datastore and Redis read access, and rotate potentially exposed OAuth tokens. No fixed version is recorded in the advisory.",
  "vendor": "ExpressGateway",
  "product": "express-gateway",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.16.11"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "express-gateway",
      "purl": null
    }
  ],
  "cwes": [
    1394
  ],
  "cvss_score": 7.4,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.0032,
  "epss_percentile": 0.2308,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 18.754842933333332,
  "t0_at": "2026-10-07T12:48:19.043000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-07T12:48:19.043000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T12:48:19.043000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107177"
    }
  }
}