CVE-2026-74896

opensslencrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute traversal techniques. Attackers can use class, bases, subclasses, and globals chains to access restricted functions and execute arbitrary...

CVE-2026-74896 openssl_encrypt before 1.4.0 Sandbox Escape via Dunder Attribute Traversal

opensslencrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute traversal techniques. Attackers can use class, bases, subclasses, and globals chains to access restricted functions and execute arbitrary...

CVE-2026-74893 openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded Secrets

opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs...

CVE-2026-74893 openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded Secrets

opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs...

EUVD-2026-60112

opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs...

CVE-2026-74893 openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded Secrets

opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs...

CVE-2026-74893

openssl_encrypt (PyPI package) versions before 1.4.0 hardcode default JWT signing secrets in config.py that bypass validation checks. Anyone with source-code access can forge valid JWT tokens for any client_id, gaining authenticated access to keyserver and telemetry APIs. CVSS 3.1 score is 8.8 (H...

CVE-2026-74893

opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs...

CVE-2026-74890

opensslencrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTESTCURRENTTEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticat...

CVE-2026-74890 openssl_encrypt before 1.4.0 HMAC Authentication Bypass via Environment Variable

opensslencrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTESTCURRENTTEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticat...

CVE-2026-74890 openssl_encrypt before 1.4.0 HMAC Authentication Bypass via Environment Variable

opensslencrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTESTCURRENTTEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticat...

EUVD-2026-60109

opensslencrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTESTCURRENTTEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticat...

CVE-2026-74890 openssl_encrypt before 1.4.0 HMAC Authentication Bypass via Environment Variable

opensslencrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTESTCURRENTTEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticat...

CVE-2026-74890

openssl_encrypt versions before 1.4.0 have an authentication bypass in the CamelliaCipher component: setting the PYTEST_CURRENT_TEST environment variable disables HMAC tag generation and verification, allowing attackers with code execution to produce unauthenticated ciphertext and bypass integrit...

CVE-2026-74886 openssl_encrypt before 1.4.0 Plugin Import Guard Bypass

opensslencrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUSMODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous...

CVE-2026-74886 openssl_encrypt before 1.4.0 Plugin Import Guard Bypass

opensslencrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUSMODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous...

EUVD-2026-60105

opensslencrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUSMODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous...

CVE-2026-74887 openssl_encrypt before 1.4.0 Insecure Random Import in PQC Module

opensslencrypt before 1.4.0 imports Python's non-cryptographic 'random' module Mersenne Twister PRNG at line 15 of opensslencrypt/modules/pqc.py. No direct calls to random. were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that...

EUVD-2026-60106

opensslencrypt before 1.4.0 imports Python's non-cryptographic 'random' module Mersenne Twister PRNG at line 15 of opensslencrypt/modules/pqc.py. No direct calls to random. were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that...

CVE-2026-74886

In openssl_encrypt before 1.4.0, PluginImportGuard blocks a different module set than the AST analyzer's DANGEROUS_MODULES, allowing attackers to bypass AST checks via string obfuscation and import modules like sys, pickle, or multiprocessing for arbitrary code execution. CVSS 9.8 critical. No in...