CVE-2026-74901

CRITICAL 9.8CVE-2026-74901 · GHSA-w4j7-wfgw-r52w · PYSEC-2026-3773 · Published 17/08/2026 · updated 01/09/2026

In short

CVE-2026-74901 is a CRITICAL (CVSS 9.8) vulnerability affecting openssl-encrypt, openssl encrypt (jahlives).
Chance of exploitation in the next 30 days (EPSS): 0.40%, higher than 34.7% of all vulnerabilities.
Fix: update to 1.4.0 or later.

Package	Affected versions	Patched versions
openssl-encrypt PyPI	`< 1.4.0`	`1.4.0`
openssl encrypt jahlives	`< 1.4.0`	`1.4.0`

Description

openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify ciphertext in transit to bypass integrity verification and perform bit-flipping attacks without detection.

NVD description

References

jahlives/openssl_encrypt security advisory · ADVISORY
vulncheck.com/advisories/openssl-encrypt-before-authentication-bypass-via-aes-ctr-fallback · ADVISORY

More vulnerabilities in openssl-encrypt

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

openssl-encrypt

PyPI

< 1.4.0

1.4.0

openssl encrypt

jahlives

< 1.4.0

1.4.0

Description

NVD description

More vulnerabilities in openssl-encrypt

See all →