Critical severity9.8OSV Advisory· Published Aug 17, 2026· Updated Sep 1, 2026
CVE-2026-74894
CVE-2026-74894
Description
openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2<1.4.0+ 1 more
- (no CPE)range: <1.4.0
- (no CPE)
Patches
Vulnerability mechanics
References
2- github.com/jahlives/openssl_encrypt/security/advisories/GHSA-4g2c-wpgj-49w8nvdMitigationVendor Advisory
- www.vulncheck.com/advisories/openssl-encrypt-before-authentication-bypass-via-bearer-tokennvdThird Party Advisory
News mentions
1- Jahlives openssl_encrypt: 25 Critical Flaws Including Auth Bypass and Sandbox Escapes Disclosed TogetherVypr Intelligence · Aug 17, 2026