CRITICALVulnerability

CVE-2026-74894

openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header.

Properties

severity
CRITICAL
score
9.8
epss_score
0.00374
cve_id
CVE-2026-74894
vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
published_at
2026-08-17T11:16:44.523
last_modified
2026-09-01T15:25:06.733
epss_percentile
0.30422

Related Entities (4)

ENRICHED_BY (1)

[Source]FIRST EPSS

AFFECTS_PRODUCT (1)

[Product]

HAS_WEAKNESS (1)

[Weakness]Improper Authentication

DESCRIBED_BY (1)

[Source]NVD

Explore deeper with Ninja Signal's threat intelligence graph

CVE-2026-74894 — Ninja Signal Threat Intelligence | Ninja Signal