Em resumo
- CVE-2026-74894 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta openssl-encrypt, openssl encrypt (jahlives).
- Chance de exploração nos próximos 30 dias (EPSS): 0.66%, maior que 51.4% das vulnerabilidades.
- Correção: atualize para 1.4.0 ou posterior.
Description
openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header.
NVD description
openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header.
Mais vulnerabilidades de openssl-encrypt
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free