CVSS 4.0
9.3 criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NCVE-2026-74894
Critical (9.3) in jahlives openssl encrypt. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in openssl-encrypt 1.4.0.
openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header.
Severity
CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jahlives:openssl_encrypt
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| PYSEC-2026-3769 | PyPI | openssl-encrypt | <1.4.0 | 1.4.0 |