Skip to main content

openssl_encrypt EUVDEUVD-2026-60101

| CVE-2026-74882 HIGH
Insufficient Verification of Data Authenticity (CWE-345)
2026-08-17 VulnCheck GHSA-24vg-mjm2-36jv
Authentication Bypass Openssl Encrypt
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

AV:A because exploitation is explicitly constrained to RFC 1918 private network adjacency, directly contradicting the provided AV:N; PR:N because no prior authentication is required to send the forged header.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Aug 17, 2026 - 13:13 vuln.today
Patch available
Aug 17, 2026 - 12:01 EUVD
CVE Published
Aug 17, 2026 - 11:04 cve.org
HIGH 8.7

DescriptionCVE.org

openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation is relaxed or modified.

AnalysisAI

openssl_encrypt (jahlives, versions before 1.4.0) ships with an insecure default trusted_proxies configuration that grants implicit trust to all RFC 1918 private address space in IntegrityProxyConfig, enabling mutual TLS authentication bypass via forged client certificate headers. Any attacker with access to a co-located private network segment can inject a crafted header that the library accepts as a legitimate certificate identity, effectively impersonating an authenticated mTLS principal. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain private network adjacency
Delivery
Craft HTTP request with forged client certificate header
Exploit
Library evaluates source as RFC 1918 trusted
Execution
ProxyAuth accepts forged identity without cryptographic check
Persist
Authentication bypass granted
Impact
Exfiltrate data accessible to impersonated mTLS principal
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to have network-level presence on an RFC 1918 private address range (10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16) from which requests can reach the target application. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) scores this at 8.7, indicating a high-severity, low-complexity flaw with high confidentiality impact and no integrity or availability component. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with access to any RFC 1918 private network segment reachable by the target application crafts an HTTP request containing a forged client certificate header, impersonating a legitimate mTLS identity. Because openssl_encrypt before 1.4.0 trusts all RFC 1918 sources by default, the library accepts the forged header without cryptographic verification and grants access as the spoofed principal. …
Remediation Upgrade openssl_encrypt to version 1.4.0 or later, which corrects the insecure default configuration in IntegrityProxyConfig. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all applications and services using openssl_encrypt (jahlives) to determine which systems are affected; confirm current versions in use and identify any that run versions before 1.4.0. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Openssl Encrypt

View all
CVE-2026-74872 CRITICAL
9.3 Aug 17

Arbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from i
CVE-2026-74899 CRITICAL
9.3 Aug 17

Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break ou
CVE-2026-74887 CRITICAL
9.3 Aug 17

Insecure PRNG import in the jahlives openssl_encrypt Python package (all versions before 1.4.0) places Python's non-cryp
CVE-2026-74901 CRITICAL
9.3 Aug 17

Authentication bypass in the openssl_encrypt Python library (versions before 1.4.0) lets attackers who can tamper with c
CVE-2026-74900 CRITICAL
9.3 Aug 17

Cryptographic shared-secret disclosure in the openssl_encrypt Python library (maintainer 'jahlives') before 1.4.0 lets a
CVE-2026-74896 CRITICAL
9.3 Aug 17

Sandbox escape leading to remote code execution affects openssl_encrypt (the jahlives Python package) in all versions be
CVE-2026-74895 CRITICAL
9.3 Aug 17

Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run wit
CVE-2026-74894 CRITICAL
9.3 Aug 17

Authentication bypass in the jahlives openssl_encrypt library (all versions before 1.4.0) lets remote unauthenticated at
CVE-2026-74890 CRITICAL
9.3 Aug 17

Integrity-protection bypass in the jahlives openssl_encrypt Python library (all versions before 1.4.0) lets an attacker

CVE-2026-74889 CRITICAL
9.3 Aug 17

Weak cryptographic key derivation in the openssl_encrypt Python library (all versions before 1.4.0) stems from its key-n
CVE-2026-74886 CRITICAL
9.3 Aug 17

Arbitrary code execution in jahlives openssl_encrypt before 1.4.0 stems from an inconsistent sandbox: the runtime Plugin
CVE-2026-74885 CRITICAL
9.3 Aug 17

Audit-trail corruption and a security-control race condition in the Python library openssl_encrypt (by jahlives) before

Same weakness CWE-345 – Insufficient Verification of Data Authenticity

View all
CVE-2023-38831 HIGH POC
7.8
CVE-2016-4553 HIGH
8.6
CVE-2016-4554 HIGH
8.6
CVE-2014-4936 CRITICAL POC
9.3
CVE-2025-66255 CRITICAL POC
9.9
CVE-2025-1945 CRITICAL POC
9.8
CVE-2024-11666 CRITICAL POC
9.8
CVE-2024-1554 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-60101 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy