Skip to main content

openssl_encrypt CVE-2026-74892

| EUVDEUVD-2026-60111 HIGH
Use of Hard-coded Credentials (CWE-798)
2026-08-17 VulnCheck GHSA-qg6r-j76g-wv2q
Authentication Bypass Openssl Encrypt
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-accessible with no authentication required; confidentiality impact high due to full telemetry API auth bypass; no integrity or availability impact confirmed by description or CVSS 4.0 vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Aug 17, 2026 - 13:05 vuln.today
Patch available
Aug 17, 2026 - 12:01 EUVD
CVE Published
Aug 17, 2026 - 11:04 cve.org
HIGH 8.7

DescriptionCVE.org

openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication.

AnalysisAI

Authentication bypass in the jahlives/openssl_encrypt PHP library (all versions before 1.4.0) exposes deployments running the standalone telemetry server to full API authentication compromise via hardcoded credentials. The static default secret key embedded in the telemetry server configuration is used for API key hashing; any attacker who obtains this now-public value can reconstruct valid API key hashes and authenticate to the telemetry API without possessing legitimate credentials. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify network-reachable telemetry server endpoint
Delivery
Obtain hardcoded default key from public GHSA advisory
Exploit
Replicate API key hashing algorithm offline
Execution
Generate forged valid API key hash
Persist
Submit forged hash to telemetry API
Impact
Access authenticated telemetry API without credentials
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target deployment is running the standalone telemetry server component of openssl_encrypt and has not overridden the default hardcoded secret key in the server configuration. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) places this squarely in the high-priority tier: remotely exploitable, no authentication, low complexity, with a high confidentiality impact against the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker retrieves the now-public default secret key value from the GHSA-p926-6hjp-w9jw advisory, then locally replicates the API key hashing routine used by the telemetry server. Using the forged hash, they craft a valid authentication token and submit it directly to the network-accessible telemetry API endpoint, gaining authenticated access without ever possessing a legitimate API key. …
Remediation Upgrade to openssl_encrypt version 1.4.0 or later, which resolves the hardcoded secret key issue per the vendor advisory at https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-p926-6hjp-w9jw. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all systems running affected versions of jahlives/openssl_encrypt (pre-1.4.0) and segregate telemetry servers from trusted networks if feasible. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Openssl Encrypt

View all
CVE-2026-74872 CRITICAL
9.3 Aug 17

Arbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from i
CVE-2026-74899 CRITICAL
9.3 Aug 17

Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break ou
CVE-2026-74887 CRITICAL
9.3 Aug 17

Insecure PRNG import in the jahlives openssl_encrypt Python package (all versions before 1.4.0) places Python's non-cryp
CVE-2026-74901 CRITICAL
9.3 Aug 17

Authentication bypass in the openssl_encrypt Python library (versions before 1.4.0) lets attackers who can tamper with c
CVE-2026-74900 CRITICAL
9.3 Aug 17

Cryptographic shared-secret disclosure in the openssl_encrypt Python library (maintainer 'jahlives') before 1.4.0 lets a
CVE-2026-74896 CRITICAL
9.3 Aug 17

Sandbox escape leading to remote code execution affects openssl_encrypt (the jahlives Python package) in all versions be
CVE-2026-74895 CRITICAL
9.3 Aug 17

Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run wit
CVE-2026-74894 CRITICAL
9.3 Aug 17

Authentication bypass in the jahlives openssl_encrypt library (all versions before 1.4.0) lets remote unauthenticated at
CVE-2026-74890 CRITICAL
9.3 Aug 17

Integrity-protection bypass in the jahlives openssl_encrypt Python library (all versions before 1.4.0) lets an attacker

CVE-2026-74889 CRITICAL
9.3 Aug 17

Weak cryptographic key derivation in the openssl_encrypt Python library (all versions before 1.4.0) stems from its key-n
CVE-2026-74886 CRITICAL
9.3 Aug 17

Arbitrary code execution in jahlives openssl_encrypt before 1.4.0 stems from an inconsistent sandbox: the runtime Plugin
CVE-2026-74885 CRITICAL
9.3 Aug 17

Audit-trail corruption and a security-control race condition in the Python library openssl_encrypt (by jahlives) before

Same weakness CWE-798 – Use of Hard-coded Credentials

View all
CVE-2016-1560 CRITICAL POC
9.8
CVE-2017-14143 CRITICAL POC
9.8
CVE-2026-22769 CRITICAL
10.0
CVE-2016-5678 CRITICAL POC
9.8
CVE-2017-6558 CRITICAL POC
9.8
CVE-2015-7246 CRITICAL POC
9.8
CVE-2015-4667 CRITICAL POC
9.8
CVE-2016-10177 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-74892 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy