CVE-2026-74871

The jahlives/openssl_encrypt PHP package before 1.4.6 has a KDF bypass: in sequential XOR composition mode the final stage cancels out, so attackers with local access can crack passwords at SHA-256 speed instead of the configured memory-hard KDF cost. CVSS 6.2 (MEDIUM, local). No in-the-wild expl...