← Vulnerability feed

Vulnerability record · CVE-2026-74894 · published 17 August 2026

CVE-2026-74894: Jahlives openssl encrypt improper authentication vulnerability

JJahlives · Openssl Encrypt

openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header.

9.3 CVSS 4.0 Critical EPSS 0.66% · top 50.7% CWE-287 · Improper authentication
9.3CVSS 4.0 base score
0.66%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
1 Sep 2026Last modified by NVD

Description

openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-4g2c-wpgj-49w8 MitigationVendor Advisory
https://www.vulncheck.com/advisories/openssl-encrypt-before-authentication-bypass-via-bearer-token Third Party Advisory

Track CVE-2026-74894 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.3CVE-2026-81717Jahlives openssl encrypt improper verification of cryptographic signature vulnerabilityopenssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the r…EPSS 0.12%9.3CVE-2026-81719Jahlives openssl encrypt code injection vulnerabilityopenssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an …EPSS 0.44%9.3CVE-2026-81706Jahlives openssl encrypt insufficient verification of data authenticity vulnerabilityopenssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create…EPSS 0.18%9.3CVE-2026-81714Jahlives openssl encrypt improper verification of cryptographic signature vulnerabilityopenssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing t…EPSS 0.20%9.3CVE-2026-81698Jahlives openssl encrypt os command injection vulnerabilityopenssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrust…EPSS 0.43%9.3CVE-2026-81700Jahlives openssl encrypt improper verification of cryptographic signature vulnerabilityopenssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired k…EPSS 0.35%9.3CVE-2026-81701Jahlives openssl encrypt improper verification of cryptographic signature vulnerabilityopenssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directorie…EPSS 0.43%9.3CVE-2026-81702Jahlives openssl encrypt insufficient verification of data authenticity vulnerabilityopenssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitut…EPSS 0.19%

Source: NIST National Vulnerability Database (record CVE-2026-74894), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.