CVE-2026-74890
MediumCVSS 5.5Summary
openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTEST_CURRENT_TEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticated ciphertext and bypass integrity protection on encrypted data.
Risk Assessment
An attacker can modify encrypted data without detection, potentially leading to data integrity compromise and further attacks.
Recommendation
Update openssl_encrypt to version 1.4.0 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTEST_CURRENT_TEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticated ciphertext and bypass integrity protection on encrypted data.