Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-74893

openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded Secrets

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any client_id to gain authenticated access to keyserver and telemetry APIs.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

jahlives openssl_encrypt

Default version status: unaffected

  • 0 to < 1.4.0affected
  • 1.4.0unaffected
pkg:pypi/openssl_encrypt

References