Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-74901

openssl_encrypt before 1.4.0 Authentication Bypass via AES-CTR Fallback

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify ciphertext in transit to bypass integrity verification and perform bit-flipping attacks without detection.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

jahlives openssl_encrypt

Default version status: unaffected

  • 0 to < 1.4.0affected
  • 1.4.0unaffected
pkg:pypi/openssl_encrypt

References