CVE-2026-74894 — openssl_encrypt before 1.4.0 Authentication Bypass via Bearer Token
openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. …
Published: 2026-08-17 · CVSS: 9.3 · CVSS 4.0
openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7