---
id: CVE-2026-74894
title: openssl_encrypt before 1.4.0 Authentication Bypass via Bearer Token
summary: >-
  openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability
  in the verify_api_token function that accepts any non-empty Bearer token
  string without validation. Attackers can upload arbitrary public keys,
  enumerate all ke…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-287
vendor: jahlives
product: openssl_encrypt
affected:
  - openssl_encrypt < 1.4.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-08-17T16:00:51.628767Z'
published: '2026-08-17'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T15:21:03.130Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74894'
references:
  - url: >-
      https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-4g2c-wpgj-49w8
    label: GitHub Security Advisory (GHSA-4g2c-wpgj-49w8)
  - url: >-
      https://www.vulncheck.com/advisories/openssl-encrypt-before-authentication-bypass-via-bearer-token
    label: >-
      VulnCheck Advisory: openssl_encrypt before 1.4.0 Authentication Bypass via
      Bearer Token
tags:
  - cve.org
  - osv
  - pip
epss: 0.00655
epssPercentile: 0.5115
aliases:
  - PYSEC-2026-3769
  - GHSA-4g2c-wpgj-49w8
ecosystem: pip
patched:
  - openssl-encrypt 1.4.0
ingestedAt: '2026-09-02T19:31:25.783Z'
---

## Overview

openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header.

## Affected

- `openssl_encrypt < 1.4.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-74894)

Affected packages:

- `openssl-encrypt < 1.4.0`

Patched in:

- `openssl-encrypt 1.4.0`

Source: https://osv.dev/vulnerability/PYSEC-2026-3769