CVE-2026-74893
1 advisory.
PyPI/openssl-encrypt CVE-2026-74893: unknown, EPSS 0.45%
openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any cl
Action: Upgrade openssl-encrypt to 1.4.0 or later.
pip install openssl-encrypt==1.4.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.4.0 | - |
Fixed versions
| 1.4.0 |
Sources
- osv: PYSEC-2026-3768
- https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-qc6h-gfjh-7qqg
- https://www.vulncheck.com/advisories/openssl-encrypt-before-jwt-token-forgery-via-hardcoded-secrets
CVE-2026-74893 · published · modified · JSON