The vulnerability in openssl_encrypt permits refresh tokens to be passed as query string values for keyserver and telemetry endpoints. These URL parameters are logged by the server, captured by proxy logs, stored in browser history, or transmitted via HTTP Referer headers, thereby revealing tokens to anyone who can read those artifacts. The practical result is that an attacker can acquire a valid refresh token and subsequently use it to gain elevated access or persistence within the system, constituting a severe information‑disclosure flaw (CWE‑598).

The issue affects the openssl_encrypt package maintained by jahlives. All releases prior to version 1.4.0 are vulnerable, so any deployment using an older version is at risk.

The flaw carries a CVSS score of 9.3, indicating critical severity. EPSS data is not available, and the vulnerability is not currently listed in the KEV catalog, but the exploitation path remains straightforward: an attacker sends a crafted HTTP request that includes a legitimate refresh token in the query string to the keyserver or telemetry route, logs the response or monitors server logs, and later reads the token from those artifacts. Network access to the target service and the ability to observe logs or browsing history are the primary prerequisites for exploitation. Consequently, the risk of widespread accidental exploitation is high given the ubiquity of the components involved.