CVE-2026-74880

### Summary Refresh tokens are accepted as URL query parameters in the keyserver and telemetry server routes. ### Affected Code ```python # openssl_encrypt_server/modules/keyserver/routes.py:214-215 # openssl_encrypt_server/modules/telemetry/routes.py:90-91 async def refresh_token( request: Request, refresh_token: str = Query(..., description="Refresh token") ): ``` ### Impact Tokens in URL query parameters are exposed in: - Server access logs - Proxy/CDN logs - Browser history - HTTP Referer headers - Network monitoring tools This creates significant token leakage risk. ### Recommended Fix - Accept refresh tokens in the request body (POST) instead of query parameters - Use `Body(...)` instead of `Query(...)` ### Fix Fixed in commit `4b2adb0` on branch `releases/1.4.x` — moved refresh token from Query parameter to POST body via RefreshRequest Pydantic model.

openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.