Which versions of openssl_encrypt are affected by EUVD-2026-60106?

The jahlives openssl_encrypt Python package (versions before 1.4.0) contains a latent code defect that increases the risk of cryptographic compromise if modified by future developers, potentially…. A patch is available.

How to fix or mitigate EUVD-2026-60106?

Within 24 hours, inventory all systems and applications using openssl_encrypt versions prior to 1.4.0 and assess deployment scope. Within 7 days, begin upgrading to openssl_encrypt version 1.4.0 or later across development, staging, and production environments, prioritizing production systems first. Complete all upgrades within 30 days and validate that no legacy versions remain in active use via dependency scanning.

openssl_encrypt EUVD-2026-60106

Q: What is the CVSS score of EUVD-2026-60106?

EUVD-2026-60106 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-74887 MEDIUM

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)

2026-08-17 VulnCheck

GHSA-j466-q253-mxp8

Python Information Disclosure Openssl Encrypt Jahlives

6.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.3 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.7 LOW

Shipped code never calls the PRNG so present impact is near-zero; I score only the latent confidentiality hazard as C:L with AC:H (needs future misuse plus ~624-output state recovery), not the published 9.3.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 28, 2026 - 20:22 NVD

CRITICAL MEDIUM

CVSS changed

Aug 28, 2026 - 20:22 NVD

9.3 (CRITICAL) 6.3 (MEDIUM)

Analysis Generated

Aug 17, 2026 - 13:09 vuln.today

Patch available

Aug 17, 2026 - 12:01 EUVD

CVE Published

Aug 17, 2026 - 11:04 cve.org

CRITICAL 9.3

DescriptionCVE.org

openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PRNG) at line 15 of openssl_encrypt/modules/pqc.py. No direct calls to random.* were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that future code could inadvertently use random.randint() instead of a cryptographically secure alternative (secrets/os.urandom), producing predictable values since the Mersenne Twister state can be recovered from approximately 624 outputs. Fixed by removing the import in 1.4.0.

Articles & Coverage 2

News 10 New Python Vulnerabilities - 3 Critical, 7 High, 2 With POC Aug 18, 2026 News Critical Insecure PRNG Import in jahlives openssl_encrypt Python Package - CVE-2026-74887 Aug 17, 2026

AnalysisAI

Insecure PRNG import in the jahlives openssl_encrypt Python package (all versions before 1.4.0) places Python's non-cryptographic 'random' module (Mersenne Twister) into openssl_encrypt/modules/pqc.py, though the code makes no calls to it, so no cryptographic operation is presently weakened. VulnCheck reported this as a latent hazard: the import invites future maintainers to reach for random.randint() instead of secrets/os.urandom, which would yield predictable values recoverable from ~624 outputs. There is no public exploit identified at time of analysis and it is not on CISA KEV; the flaw was fixed by removing the import in version 1.4.0.

Technical ContextAI

The affected component is a Python cryptographic wrapper library (cpe:2.3:a:jahlives:openssl_encrypt) whose post-quantum crypto helper module (modules/pqc.py) imports the standard-library 'random' module at line 15. Python's 'random' is backed by the Mersenne Twister (MT19937) deterministic PRNG, whose full 19937-bit internal state can be reconstructed from roughly 624 consecutive 32-bit outputs, after which all future outputs are predictable. This maps to CWE-338 (Use of Cryptographically Weak PRNG): the correct primitives for key/nonce/salt generation are the 'secrets' module or os.urandom (CSPRNGs seeded from the OS entropy pool). Critically, per the description the module contains only the import with no random.* invocations, so the weakness is architectural/potential rather than an active cryptographic defect in shipped code.

RemediationAI

Upgrade to openssl_encrypt 1.4.0 or later - Vendor-released patch: 1.4.0, which removes the offending 'random' import from modules/pqc.py per the GitHub Security Advisory GHSA-cx72-m6xj-3vf6 (https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-cx72-m6xj-3vf6). Because there are no random.* calls in vulnerable versions, no functional cryptographic behavior changes on upgrade and there is no runtime compensating control needed to block exploitation of shipped code; the practical action is simply to update the dependency and, if maintaining a fork, audit the module to confirm all key/nonce/salt generation uses 'secrets' or os.urandom rather than 'random'. For organizations unable to upgrade immediately, the low real-world risk means it can be scheduled as routine dependency maintenance, while adding a static-analysis/lint rule (e.g., flag any use of the 'random' module in crypto modules) prevents the latent hazard from becoming a live one.