CVE-2026-74893 openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded Secrets
Attackers can forge JWT tokens using hardcoded secrets to gain unauthorized access to APIs in the openssl_encrypt library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74893?
CVE-2026-74893 is a high-severity vulnerability in Jahlives Openssl Encrypt, published on 17 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any client_id to gain authenticated access to keyserver and telemetry APIs.
Weakness: CWE-798
Which versions are affected by CVE-2026-74893?
1 open source package ship an affected version, including openssl-encrypt. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
openssl-encrypt PyPI | All versions | 1.4.0 |
Products include Jahlives Openssl Encrypt.
How do I fix CVE-2026-74893?
Upgrade openssl-encrypt to 1.4.0 or later.
Is CVE-2026-74893 being exploited?
There is no known exploitation of CVE-2026-74893 in the wild and no public exploit code.
Other vulnerabilities in Jahlives Openssl Encrypt
- CVE-2026-81680 openssl_encrypt before 1.4.9 Authentication Bypass via Recovery Slot Removal
- CVE-2026-81681 openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage
- CVE-2026-81685 openssl_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata
- CVE-2026-81694 openssl-encrypt before 1.4.9 Output Injection via Unsanitized Filenames in verify-usb Command
- CVE-2026-81695 openssl_encrypt before 1.4.9 Terminal Injection via key_id
Sources
Also known as GHSA-pj24-vj9g-8vg8, GHSA-qc6h-gfjh-7qqg, PYSEC-2026-3768.