CVE-2026-74890CWE-345

CVE-2026-74890

Medium · published August 17, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
11.0
In the wild
Unconfirmed
What it is

openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTEST_CURRENT_TEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticated ciphertext and bypass integrity protection on encrypted data.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00213 · 11.0th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2026-08-17T15:16Z
Affected products (1)
ProductVersionsFixed in
jahlives/openssl_encrypt< 1.4.01.4.0
References (2)
https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-rvc2-5jxq-gpcj · [email protected]https://www.vulncheck.com/advisories/openssl-encrypt-before-hmac-authentication-bypass-via-environment-variable · [email protected]
EPSS history
Timeline
  • 17 AUG 11:04Z
    openssl_encrypt before 1.4.0 HMAC Authentication Bypass via Environment Variable
    cvelistv5