High severity7.5OSV Advisory· Published Aug 17, 2026· Updated Aug 31, 2026

CVE-2026-74892

Description

openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Jahlives/Openssl EncryptOSV2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <1.4.0

Patches

Vulnerability mechanics

References

github.com/jahlives/openssl_encrypt/security/advisories/GHSA-p926-6hjp-w9jwnvdMitigationVendor Advisory
www.vulncheck.com/advisories/openssl-encrypt-before-hardcoded-secret-keynvdThird Party Advisory

News mentions

Jahlives openssl_encrypt: 25 Critical Flaws Including Auth Bypass and Sandbox Escapes Disclosed Together
Vypr Intelligence · Aug 17, 2026

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000