CVE-2026-74894

PYSEC-2026-3769 · CVE-2026-74894 · GHSA-4g2c-wpgj-49w8

Published Aug 17, 2026 · Modified Sep 2, 2026

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header.

References

ADVISORY https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-4g2c-wpgj-49w8
ADVISORY https://www.vulncheck.com/advisories/openssl-encrypt-before-authentication-bypass-via-bearer-token

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes

CVE-2026-74894

Description

References

More PyPI vulnerabilities

Start Securing