CVE-2026-74877 openssl_encrypt before 1.4.0 Missing Ownership Verification via revoke_key

What is CVE-2026-74877?

CVE-2026-74877 is a high-severity missing authorization vulnerability in Jahlives Openssl Encrypt, published on 17 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

openssl_encrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revoke_key method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership restriction.

Weakness: CWE-639

Which versions are affected by CVE-2026-74877?

3 open source packages ship an affected version, including openssl-encrypt. It affects 1 product.

Products include Jahlives Openssl Encrypt.

How do I fix CVE-2026-74877?

Upgrade openssl-encrypt to 1.4.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-74877 being exploited?

There is no known exploitation of CVE-2026-74877 in the wild and no public exploit code.

Other vulnerabilities in Jahlives Openssl Encrypt

• CVE-2026-81680 openssl_encrypt before 1.4.9 Authentication Bypass via Recovery Slot Removal Critical 9.3
• CVE-2026-81681 openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage Critical 9.3
• CVE-2026-81685 openssl_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata Critical 9.3
• CVE-2026-81694 openssl-encrypt before 1.4.9 Output Injection via Unsanitized Filenames in verify-usb Command Critical 9.3
• CVE-2026-81695 openssl_encrypt before 1.4.9 Terminal Injection via key_id Critical 9.3

All Jahlives Openssl Encrypt vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-hmf7-54mh-cvp4, GHSA-hvc7-763r-4f3h, PYSEC-2026-3743.