CVE-2026-74894
CriticalCVSS 9.8Summary
openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header.
Risk Assessment
The risk is that unauthorized users can manipulate public keys, potentially leading to compromise of key system integrity and service availability.
Recommendation
Immediately upgrade openssl_encrypt to version 1.4.0 or later to fix token verification.
Original NVD description (English source)
openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header.