GHSA-4rh7-jwg9-m28m: 
Python vulnerability analysis and mitigation

Summary

Refresh tokens are accepted as URL query parameters in the keyserver and telemetry server routes.

Affected Code

# openssl_encrypt_server/modules/keyserver/routes.py:214-215

# openssl_encrypt_server/modules/telemetry/routes.py:90-91
async def refresh_token(
    request: Request,
    refresh_token: str = Query(..., description="Refresh token")
):

Impact

Tokens in URL query parameters are exposed in:

• Server access logs
• Proxy/CDN logs
• Browser history
• HTTP Referer headers
• Network monitoring tools This creates significant token leakage risk.

Recommended Fix

• Accept refresh tokens in the request body (POST) instead of query parameters
• Use Body(...) instead of Query(...)

Fix

Fixed in commit 4b2adb0 on branch releases/1.4.x — moved refresh token from Query parameter to POST body via RefreshRequest Pydantic model.