CVE-2026-74881 openssl_encrypt before 1.4.0 CORS Misconfiguration via Wildcard Origins

What is CVE-2026-74881?

CVE-2026-74881 is a high-severity vulnerability in Jahlives Openssl Encrypt, published on 17 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

openssl_encrypt versions before 1.4.0 configure CORS with allow_origins set to wildcard and allow_credentials enabled to true. Attackers can create malicious websites that make authenticated cross-origin requests to the API on behalf of any user who visits them.

Weakness: CWE-942

Which versions are affected by CVE-2026-74881?

3 open source packages ship an affected version, including openssl-encrypt. It affects 1 product.

Products include Jahlives Openssl Encrypt.

How do I fix CVE-2026-74881?

Upgrade openssl-encrypt to 1.4.0 or later.

Is CVE-2026-74881 being exploited?

There is no known exploitation of CVE-2026-74881 in the wild and no public exploit code.

Other vulnerabilities in Jahlives Openssl Encrypt

• CVE-2026-81680 openssl_encrypt before 1.4.9 Authentication Bypass via Recovery Slot Removal Critical 9.3
• CVE-2026-81681 openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage Critical 9.3
• CVE-2026-81685 openssl_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata Critical 9.3
• CVE-2026-81694 openssl-encrypt before 1.4.9 Output Injection via Unsanitized Filenames in verify-usb Command Critical 9.3
• CVE-2026-81695 openssl_encrypt before 1.4.9 Terminal Injection via key_id Critical 9.3

All Jahlives Openssl Encrypt vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-243r-jm6r-f6pp, GHSA-c65f-x25w-62jv, PYSEC-2026-3977.