Authentication Bypass in OpenSSL Encrypt Affected by Bearer Token Manipulation

CVE-2026-74894

What is CVE-2026-74894?

OpenSSL Encrypt versions prior to 1.4.0 suffer from an authentication bypass vulnerability in the verify_api_token function. This flaw allows malicious entities to exploit the system by accepting any non-empty Bearer token string without proper validation. Attackers gain the ability to upload arbitrary public keys, enumerate all existing keys, and revoke keys belonging to legitimate users merely by providing any Bearer token in the Authorization header. Immediate action is recommended for users utilizing affected versions.

References