CVE-2026-74878
CriticalCVSS 9.8Summary
openssl_encrypt before version 1.4.0 uses an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate limiting protections.
Risk Assessment
The risk is that attackers can perform effective brute-force attacks on TOTP codes, potentially leading to unauthorized access to user accounts.
Recommendation
It is recommended to immediately upgrade openssl_encrypt to version 1.4.0 or later, which includes the fix.
Original NVD description (English source)
openssl_encrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate limiting protections.