Skip to main content

openssl_encrypt CVE-2026-74887

| EUVDEUVD-2026-60106 CRITICAL
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)
2026-08-17 VulnCheck GHSA-j466-q253-mxp8
Python Information Disclosure Openssl Encrypt
9.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.7 LOW

Shipped code never calls the PRNG so present impact is near-zero; I score only the latent confidentiality hazard as C:L with AC:H (needs future misuse plus ~624-output state recovery), not the published 9.3.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Aug 17, 2026 - 13:09 vuln.today
Patch available
Aug 17, 2026 - 12:01 EUVD
CVE Published
Aug 17, 2026 - 11:04 cve.org
CRITICAL 9.3

DescriptionCVE.org

openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PRNG) at line 15 of openssl_encrypt/modules/pqc.py. No direct calls to random.* were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that future code could inadvertently use random.randint() instead of a cryptographically secure alternative (secrets/os.urandom), producing predictable values since the Mersenne Twister state can be recovered from approximately 624 outputs. Fixed by removing the import in 1.4.0.

Articles & Coverage 2

News 10 New Python Vulnerabilities - 3 Critical, 7 High, 2 With POC Aug 18, 2026 News Critical Insecure PRNG Import in jahlives openssl_encrypt Python Package - CVE-2026-74887 Aug 17, 2026

AnalysisAI

Insecure PRNG import in the jahlives openssl_encrypt Python package (all versions before 1.4.0) places Python's non-cryptographic 'random' module (Mersenne Twister) into openssl_encrypt/modules/pqc.py, though the code makes no calls to it, so no cryptographic operation is presently weakened. VulnCheck reported this as a latent hazard: the import invites future maintainers to reach for random.randint() instead of secrets/os.urandom, which would yield predictable values recoverable from ~624 outputs. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify future code using imported random PRNG
Delivery
Collect ~624 consecutive PRNG outputs
Exploit
Recover Mersenne Twister internal state
Execution
Predict generated keys/nonces
Impact
Decrypt or forge protected data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation As shipped, the vulnerability is NOT exploitable: the 'random' module is imported but never called, so there is no code path an attacker can reach - this is a latent hazard, not a live weakness. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Signals conflict sharply. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario No exploitable path exists in shipped versions because the imported PRNG is never invoked. The realistic future scenario is that a maintainer adds a call such as random.randint() in pqc.py to generate a key, nonce, or salt; an attacker who observes ~624 outputs then reconstructs the Mersenne Twister state and predicts all subsequent 'random' values, defeating the confidentiality of derived secrets. …
Remediation Upgrade to openssl_encrypt 1.4.0 or later - Vendor-released patch: 1.4.0, which removes the offending 'random' import from modules/pqc.py per the GitHub Security Advisory GHSA-cx72-m6xj-3vf6 (https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-cx72-m6xj-3vf6). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all systems and applications using openssl_encrypt versions prior to 1.4.0 and assess deployment scope. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Python

View all
CVE-2025-24016 CRITICAL POC
9.9 Feb 10

Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
CVE-2025-27520 CRITICAL POC
9.8 Apr 04

BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
CVE-2025-2945 CRITICAL POC
9.9 Apr 03

pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
CVE-2013-5093 MEDIUM POC
6.8 Sep 27

The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python

CVE-2025-32375 CRITICAL POC
9.8 Apr 09

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2024-21644 HIGH POC
7.5 Jan 08

pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
CVE-2026-33017 CRITICAL POC
9.3 Mar 17

Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
CVE-2017-9462 HIGH POC
8.8 Jun 06

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
CVE-2026-39987 CRITICAL POC
9.3 Apr 08

Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
CVE-2024-21645 MEDIUM POC
5.3 Jan 08

pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
CVE-2026-55255 HIGH POC
8.4 Jun 19

Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing

Same weakness CWE-338 – Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

View all
CVE-2023-36993 CRITICAL POC
9.8
CVE-2019-16303 CRITICAL POC
9.8
CVE-2026-73567 CRITICAL POC
9.1
CVE-2024-29868 CRITICAL POC
9.1
CVE-2022-35255 CRITICAL POC
9.1
CVE-2025-1796 HIGH POC
8.8
CVE-2023-27791 HIGH POC
8.1
CVE-2019-10754 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-74887 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy