Which versions of openssl_encrypt are affected by EUVD-2026-60093?

openssl_encrypt versions prior to 1.4.0 use cryptographically weak random number generation in their steganography module, enabling attackers with knowledge of the concealment password to recover…. A patch is available.

How to fix or mitigate EUVD-2026-60093?

Within 24 hours, audit infrastructure and applications to identify all instances of openssl_encrypt usage, particularly in security-sensitive steganographic workflows. Within 7 days, upgrade all affected deployments to version 1.4.0 or later; coordinate with development teams to prioritize applications protecting classified or sensitive concealed data. Within 30 days, complete patch validation across all environments, audit historical steganographic deployments to assess exposure window, and consider re-concealing any previously hidden data using the patched version to ensure long-term confidentiality.

openssl_encrypt EUVD-2026-60093

Q: What is the CVSS score of EUVD-2026-60093?

EUVD-2026-60093 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-74874 HIGH

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)

2026-08-17 VulnCheck

GHSA-844w-mwfp-wjwf

Python Information Disclosure Openssl Encrypt Jahlives

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

AC:H because exploitation requires knowing or brute-forcing the password-derived 64-bit seed before PRNG state can be reconstructed; C:H for full steganographic payload disclosure; no integrity or availability impact applies.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 17, 2026 - 13:18 vuln.today

Analysis Generated

Aug 17, 2026 - 13:18 vuln.today

Patch available

Aug 17, 2026 - 12:01 EUVD

CVE Published

Aug 17, 2026 - 11:04 cve.org

HIGH 8.7

DescriptionCVE.org

openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generate_pseudorandom_sequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations containing hidden data for extraction.

Articles & Coverage 1

News 10 New Python Vulnerabilities - 3 Critical, 7 High, 2 With POC Aug 18, 2026

AnalysisAI

Cryptographically weak PRNG use in openssl_encrypt before 1.4.0 exposes steganographic pixel selection to full state-recovery attacks. The library's steganography module seeds Python's Mersenne Twister with only 64 bits of SHA-256 hash material derived from the user password, then uses it to select pixel positions for hidden data - a design flaw captured by CWE-338. Any attacker who knows or can brute-force the steganography password can deterministically reconstruct the PRNG sequence and enumerate every pixel carrying concealed data, breaking steganographic confidentiality entirely. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the MT state-recovery technique is well-documented and requires no novel research.

Technical ContextAI

The flaw resides in openssl_encrypt/plugins/steganography/core/utils.py at lines 89-91, where random.seed(seed) and random.sample() are invoked for pixel and audio-sample selection. Python's random module implements MT19937 (Mersenne Twister), a 19,968-bit state PRNG designed for simulation, not cryptography. Its full internal state is deterministically recoverable given 624 consecutive 32-bit outputs - a publicly known attack requiring no specialized hardware. Compounding the flaw, the seed is derived from only 8 bytes (64 bits) of the SHA-256 hash of the password, capping effective entropy at 64 bits and making offline brute-force of the seed space feasible independently of password length. CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator) precisely identifies this root cause: using a statistically sound but cryptographically insecure PRNG in a security-sensitive role. The affected CPE is cpe:2.3:a:jahlives:openssl_encrypt:*:*:*:*:*:*:*:* for all versions before 1.4.0, distributed as openssl-encrypt via pip.

RemediationAI

Upgrade to openssl-encrypt 1.4.0, which replaces the insecure random.seed(hash(password)) pattern with an HMAC-SHA256-based CSPRNG implementing Fisher-Yates shuffle and applies HMAC-derived seeds across all steganography format modules, as documented in commit 09e96e090417d34d2f533f6810d3cd4f77810101 and confirmed by the GHSA advisory at https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-vfgx-5q85-58q3. If immediate upgrade is not possible, treat all steganographic payloads produced by affected versions as potentially compromised if the password has been exposed to any third party; re-encoding hidden data using the patched version with a freshly generated password is the recommended compensating control, with the trade-off that previously distributed stego-images retain the weak pixel layout. Alternatively, disabling the steganography plugin entirely until upgrade is feasible, accepting the operational loss of steganographic functionality. Do not rely on password complexity alone as a mitigation - the 64-bit seed truncation makes the seed space brute-forceable regardless of password strength.