CRITICALVulnerability

CVE-2026-74901

openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify ciphertext in transit to bypass integrity verification and perform bit-flipping attacks without detection.

Properties

severity
CRITICAL
score
9.8
epss_score
0.00228
cve_id
CVE-2026-74901
vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
published_at
2026-08-17T11:16:45.183
last_modified
2026-09-01T16:08:27.007
epss_percentile
0.13429

Related Entities (4)

ENRICHED_BY (1)

[Source]FIRST EPSS

AFFECTS_PRODUCT (1)

[Product]

HAS_WEAKNESS (1)

[Weakness]Improper Verification of Cryptographic Signature

DESCRIBED_BY (1)

[Source]NVD

Explore deeper with Ninja Signal's threat intelligence graph

CVE-2026-74901 — Ninja Signal Threat Intelligence | Ninja Signal