CVE-2026-74894

critical · 9.3

openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header.

9.3

CVSS

0.7%

EPSS (exploit prob.)

49th

EPSS percentile

2026-08-17

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-287

Affected products

Vendor	Product	Affected versions
jahlives	openssl_encrypt	< 1.4.0

Check a specific version with /api/v1/cve/match.

References

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-4g2c-wpgj-49w8
https://www.vulncheck.com/advisories/openssl-encrypt-before-authentication-bypass-via-bearer-token

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-74894