9.8
CVE-2026-74894
- EPSS 0.39%
- Veröffentlicht 17.08.2026 11:04:56
- Zuletzt bearbeitet 01.09.2026 15:25:06
- Erkennungen
Loginopenssl_encrypt before 1.4.0 Authentication Bypass via Bearer Token
openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jahlives ≫ Openssl Encrypt SwPlatform python Version < 1.4.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.39% | 0.325 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| disclosure@vulncheck.com | 9.3 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
| disclosure@vulncheck.com | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-4g2c-wpgj-49w8
https://www.vulncheck.com/advisories/openssl-encrypt-before-authentication-bypass-via-bearer-token