Advisories · Technology

ExpressGateway express-gateway.

Every CVE that names ExpressGateway express-gateway among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-107177 CVE record

CVSS 7.4 High

Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens
- ExpressGateway express-gateway
- CWE-1394
Not analysed yet 7 Oct 2026
CVE-2026-107162 CVE record

CVSS 7.6 High

Express Gateway through 1.16.11 OAuth 2.0 Refresh Token Validation Bypass
- ExpressGateway express-gateway
- Authentication bypass
Not analysed yet 7 Oct 2026