Jahlives openssl_encrypt: 25 Critical Flaws Including Auth Bypass and Sandbox Escapes Disclosed Together
Jahlives' openssl_encrypt product impacted by 25 critical and high-severity vulnerabilities disclosed on August 17, 2026, patched in version 1.4.0.
Key findings
- 25 vulnerabilities disclosed together for Jahlives' openssl_encrypt, all fixed in version 1.4.0.
- Multiple critical flaws include authentication bypass, sandbox escapes, and arbitrary code execution.
- Insecure cryptographic practices and hardcoded secrets are prevalent across the disclosed CVEs.
- Users are urged to update to version 1.4.0 immediately to mitigate severe security risks.
On August 17, 2026, a significant batch of 25 vulnerabilities was disclosed for Jahlives' openssl_encrypt product, all fixed in version 1.4.0. The vulnerabilities, ranging in severity from Medium to Critical, expose a wide array of security weaknesses including authentication bypass, sandbox escapes, insecure configurations, and cryptographic flaws. This coordinated disclosure highlights critical security gaps in the product's handling of encryption, key management, and plugin execution.
Several vulnerabilities revolve around authentication bypass and insecure handling of credentials. CVE-2026-74901 and CVE-2026-74894 detail authentication bypass flaws in AES-GCM decryption and API token verification, respectively. CVE-2026-74891 and CVE-2026-74890 expose hardcoded database credentials and an authentication bypass via environment variables, respectively. Additionally, CVE-2026-74880 allows attackers to obtain refresh tokens from URL query parameters, while CVE-2026-74882 describes an in-memory rate limiter for TOTP that is ineffective across server workers or after restarts. CVE-2026-74878 presents a similar issue with TOTP brute-force protection, and CVE-2026-74876 allows the creation of key bundles from untrusted data without signature verification. CVE-2026-74875 highlights a critical flaw where JSON schema validation is silently skipped if the jsonschema library is not installed, allowing malformed metadata.
A significant theme among the disclosed vulnerabilities is the presence of sandbox escape flaws, particularly within plugin execution. CVE-2026-74899 and CVE-2026-74896 describe sandbox escapes in IsolatedPluginExecutor and DangerousPatternVisitor respectively, allowing attackers to traverse Python class hierarchies and execute arbitrary OS commands. CVE-2026-74895 indicates that default process isolation for plugin execution fails to restrict access to the filesystem, network, subprocesses, and Python modules. Further exacerbating these issues, CVE-2026-74883 details a sandbox bypass that fails to restrict alternative file access methods like pathlib.Path and io.open, and CVE-2026-74884 presents a path traversal vulnerability in the _is_safe_path method. CVE-2026-74886 describes a plugin sandbox bypass where the PluginImportGuard fails to block dangerous modules that the AST analyzer misses.
Cryptographic weaknesses and insecure key management practices are also prominent. CVE-2026-74900 details a critical vulnerability where KEM decapsulation failures fall back to a simulation mode, generating a deterministic shared secret. CVE-2026-74889 points to the use of HKDF with no salt and static info, reducing entropy extraction. CVE-2026-74888 highlights a non-standard PBKDF2 construction with insufficient iterations, weakening password protection. CVE-2026-74893 and CVE-2026-74877 reveal hardcoded JWT signing secrets and a missing ownership verification in key revocation, respectively. CVE-2026-74883 also touches on cryptographic issues by allowing bypass of restricted file access controls.
Other notable vulnerabilities include CVE-2026-74893, which involves hardcoded default JWT signing secrets, and CVE-2026-74892, concerning a hardcoded default secret key for API key hashing. CVE-2026-74880 highlights an issue with refresh tokens being accepted as URL query parameters. CVE-2026-74879 describes an information disclosure vulnerability in the /ready endpoint that returns full database exception strings. CVE-2026-74881 points to insecure CORS configuration with a wildcard allow_origins and allow_credentials enabled. Finally, CVE-2026-74887 notes the import of Python's non-cryptographic 'random' module, posing a future hazard.
All 25 vulnerabilities were addressed in openssl_encrypt version 1.4.0. Users are strongly advised to update to this version immediately to mitigate the extensive security risks posed by this batch of critical flaws. The wide range of issues, from authentication bypass to sandbox escapes and cryptographic weaknesses, underscores the importance of applying the patch promptly to protect sensitive data and system integrity.
The batch of 25 vulnerabilities disclosed on August 17, 2026, affects Jahlives' openssl_encrypt product, with all issues fixed in version 1.4.0. Multiple critical vulnerabilities allow for authentication bypass and sandbox escapes, enabling arbitrary code execution and unauthorized access. Insecure cryptographic practices, including weak key derivation and predictable secret generation, are present across several CVEs. Hardcoded credentials and secrets in configuration files and JWT handling pose significant risks for data exposure and unauthorized access. Users must update to openssl_encrypt version 1.4.0 to address these critical security flaws. CVE-2026-74901, CVE-2026-74900, CVE-2026-74899, CVE-2026-74896, CVE-2026-74895, CVE-2026-74894, CVE-2026-74893, CVE-2026-74892, CVE-2026-74891, CVE-2026-74890, CVE-2026-74889, CVE-2026-74888, CVE-2026-74887, CVE-2026-74886, CVE-2026-74885, CVE-2026-74884, CVE-2026-74883, CVE-2026-74882, CVE-2026-74881, CVE-2026-74880, CVE-2026-74879, CVE-2026-74878, CVE-2026-74877, CVE-2026-74876, CVE-2026-74875