{"id":"CVE-2026-74894","title":"openssl_encrypt before 1.4.0 Authentication Bypass via Bearer Token","summary":"openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all ke…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-287"],"vendor":"jahlives","product":"openssl_encrypt","affected":["openssl_encrypt < 1.4.0"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-08-17T16:00:51.628767Z"},"published":"2026-08-17","updated":"2026-10-01","sourceUpdated":"2026-10-01T15:21:03.130Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74894","references":[{"url":"https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-4g2c-wpgj-49w8","label":"GitHub Security Advisory (GHSA-4g2c-wpgj-49w8)"},{"url":"https://www.vulncheck.com/advisories/openssl-encrypt-before-authentication-bypass-via-bearer-token","label":"VulnCheck Advisory: openssl_encrypt before 1.4.0 Authentication Bypass via Bearer Token"}],"tags":["cve.org","osv","pip"],"epss":0.00655,"epssPercentile":0.5115,"aliases":["PYSEC-2026-3769","GHSA-4g2c-wpgj-49w8"],"ecosystem":"pip","patched":["openssl-encrypt 1.4.0"],"ingestedAt":"2026-09-02T19:31:25.783Z","slug":"CVE-2026-74894","body":"## Overview\n\nopenssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header.\n\n## Affected\n\n- `openssl_encrypt < 1.4.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-74894)\n\nAffected packages:\n\n- `openssl-encrypt < 1.4.0`\n\nPatched in:\n\n- `openssl-encrypt 1.4.0`\n\nSource: https://osv.dev/vulnerability/PYSEC-2026-3769","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":214443,"id":"CVE-2026-74894","ts":1790869824518,"field":"cvss","old":null,"new":"9.8"},{"seq":214442,"id":"CVE-2026-74894","ts":1790869824518,"field":"severity","old":"none","new":"critical"}]}