CVE-2026-74901

CriticalCVSS 9.8/10Last modified Sep 1, 2026

Description

openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify ciphertext in transit to bypass integrity verification and perform bit-flipping attacks without detection.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
jahlives	openssl_encrypt	< 1.4.0

References

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-w4j7-wfgw-r52wMitigation, Vendor Advisory
https://www.vulncheck.com/advisories/openssl-encrypt-before-authentication-bypass-via-aes-ctr-fallbackThird Party Advisory

Timeline

Published: Aug 17, 2026
Last modified: Sep 1, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-749028.6SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before CVE-2026-749034.3SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CVE-2026-749047.5SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, ch CVE-2026-749057.1SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP function in kernel/util/net.go, used by CVE-2026-749067.5SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results usi CVE-2026-749075.9Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching inst CVE-2026-749084.6Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', a CVE-2026-749098.1Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was CVE-2026-74918.1School App developed by Zyosoft has an Insecure Direct Object Reference vulnerability, allowing authenticated remote attackers to modify a s CVE-2026-74911Software installed and run as a non-privileged user may conduct improper GPU system calls to the execution of an error path that triggers an CVE-2026-749129.8On GPU systems with the security vulnerability fix for CVE-2026-49746 applied, the mapping range of graphics buffers is limited which causes CVE-2026-749158.8A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger a OOB read and/or write crash in the GPU