A critical information disclosure vulnerability in jahlives openssl_encrypt facilitates the leakage of sensitive refresh tokens through insecure URL query parameters.

The library incorrectly handles refresh tokens by accepting them as URL query parameters in keyserver and telemetry routes. This is an unauthenticated exposure flaw, as these tokens are frequently captured by intermediary systems and logging infrastructure.

The exposure of refresh tokens allows attackers to hijack active user sessions without requiring further authentication. This leakage can result in widespread unauthorized access to protected resources, leading to significant data compromise. With a CVSS score of 9.8, this flaw constitutes a high-risk security oversight that could lead to persistent unauthorized access.

Immediate Action: Update jahlives openssl_encrypt to version 1.4.0 or later, which addresses the insecure handling of tokens.

Proactive Monitoring: Audit existing server logs, proxy logs, and browser history for potential instances of leaked tokens that may have already occurred.

Compensating Controls: Implement strict logging policies to sanitize URLs and prevent the storage of sensitive parameters in plain text logs.

Public Exploit Available: No

Organizations must treat this vulnerability with high urgency due to the ease with which tokens can be harvested from common logging infrastructure. Applying the update to version 1.4.0 is mandatory to ensure that tokens are no longer exposed through URL parameters.