Summary
CVE-2026-74894 is a critical authentication bypass vulnerability (CWE-287: Improper Authentication) in the openssl_encrypt Python package maintained by jahlives, distributed via PyPI as openssl-encrypt. The flaw resides in the package’s verify_api_token function, which accepts any non-empty Bearer token string without performing actual validation, allowing an unauthenticated network attacker to impersonate legitimate API clients. The issue carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical).
Technical details
- Root cause: The
verify_api_tokenfunction used to authenticate requests to the package’s key server/API components fails to validate the supplied Bearer token — it treats any non-empty string as a valid credential. - Trigger conditions: An attacker simply needs to send an HTTP request to an exposed
openssl_encryptAPI endpoint with anAuthorization: Bearer <arbitrary-non-empty-string>header; no legitimate credentials, prior session, or user interaction are required. - Attack vector: Network — the vulnerability is remotely exploitable without authentication or privileges.
- Impact: Successful exploitation allows an attacker to:
- Upload arbitrary public keys to the key server as if acting on behalf of a legitimate user
- Enumerate all stored keys in the system
- Revoke keys belonging to other users, resulting in denial of service or disruption of cryptographic operations relying on those keys
- Full loss of confidentiality, integrity, and availability for the affected key management functionality
Affected software
- Product: openssl_encrypt (PyPI package
openssl-encrypt), maintained by jahlives - Affected versions: All versions prior to 1.4.0
- Fixed version: 1.4.0 and later
Severity
- CVSS v3.1 Base Score: 9.8 (Critical) —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v4.0 Base Score: 9.3 (Critical) —
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Mitigation and recommended actions
- Immediate: Upgrade
openssl_encryptto version 1.4.0 or later, which enforces proper Bearer token validation inverify_api_token. - If patching is not immediately possible:
- Restrict network exposure of any
openssl_encryptkey server/API components to trusted internal networks only; do not expose these endpoints directly to the internet. - Place the affected service behind an authenticating reverse proxy or API gateway that independently validates tokens before requests reach the vulnerable service.
- Monitor API logs for unexpected key upload, enumeration, or revocation activity as a potential indicator of exploitation.
- Rotate and re-validate any keys managed through the affected service after patching, since key integrity cannot be assured while the vulnerability was exploitable.
- Restrict network exposure of any

