CVE-2026-74881

opensslencrypt versions before 1.4.0 configure CORS with alloworigins set to wildcard and allowcredentials enabled to true. Attackers can create malicious websites that make authenticated cross-origin requests to the API on behalf of any user who visits them...

CVE-2026-74881 openssl_encrypt before 1.4.0 CORS Misconfiguration via Wildcard Origins

opensslencrypt versions before 1.4.0 configure CORS with alloworigins set to wildcard and allowcredentials enabled to true. Attackers can create malicious websites that make authenticated cross-origin requests to the API on behalf of any user who visits them...

CVE-2026-74881

openssl_encrypt (PyPI) versions before 1.4.0 ship both standalone servers (key-server and telemetry-server ) with the most permissive CORS configuration: allow_origins=["*"] combined with allow_credentials=True, allow_methods=["*"], and allow_headers=["*"]. The same wildcard default appears in do...