Authentication Bypass in OpenSSL_encrypt Affects Multiple Versions

CVE-2026-74901

What is CVE-2026-74901?

An authentication bypass vulnerability exists in the OpenSSL_encrypt library prior to version 1.4.0. This issue arises in the pqc.py module, where failure in AES-GCM decryption can inadvertently revert to an unauthenticated AES-CTR mode. As a result, an attacker is able to manipulate encrypted data in transit, allowing for integrity verification to be bypassed. This flaw opens the door for bit-flipping attacks, where malicious actors can alter the ciphertext without being detected, posing a significant risk to the security of sensitive data.

References