Authentication Bypass in OpenSSL Encryption Library by OpenSSL

CVE-2026-74890

What is CVE-2026-74890?

A vulnerability in the OpenSSL encryption library, specifically within the openssl_encrypt function, allows an attacker to bypass authentication mechanisms. This occurs due to a flaw in the CamelliaCipher implementation which disables the generation and verification of the HMAC tag when the PYTEST_CURRENT_TEST environment variable is set. When attackers can execute code, they can manipulate this environment variable to produce unauthenticated ciphertext, thereby compromising the integrity of the encrypted data.

References