CORS Misconfiguration in openssl_encrypt Affects Data Security

CVE-2026-74881

What is CVE-2026-74881?

The openssl_encrypt library, prior to version 1.4.0, is susceptible to a significant CORS configuration flaw. This vulnerability arises from the 'allow_origins' setting being configured to accept wildcard requests while simultaneously allowing credentials, which enables attackers to craft malicious websites. When users unknowingly visit these sites, the attackers can execute authenticated cross-origin requests to the API as if they are legitimate users. This misconfiguration poses serious risks to user security and data integrity.

References