Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-74890

openssl_encrypt before 1.4.0 HMAC Authentication Bypass via Environment Variable

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTEST_CURRENT_TEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticated ciphertext and bypass integrity protection on encrypted data.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

jahlives openssl_encrypt

Default version status: unaffected

  • 0 to < 1.4.0affected
  • 1.4.0unaffected
pkg:pypi/openssl_encrypt

References