{"action":"Upgrade openssl-encrypt to 1.4.0 or later.","affected":[{"fixed":"1.4.0","introduced":"0"}],"component":"openssl-encrypt","cve_ids":["CVE-2026-74877"],"ecosystem":"PyPI","epss":0.00451,"exploited":false,"fixed_versions":["1.4.0"],"ghsa_id":"GHSA-hvc7-763r-4f3h","id":"tcs_01M5KH72WQ3H9WP011R3EVB4TM","modified_at":"2026-09-01T09:15:03.520607839Z","published_at":"2026-08-17T11:16:42.203Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3743","https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-hvc7-763r-4f3h","https://www.vulncheck.com/advisories/openssl-encrypt-before-missing-ownership-verification-via-revoke-key"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2026-3743","url":"https://osv.dev/vulnerability/PYSEC-2026-3743"}],"summary":"openssl_encrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revoke_key method that allows authenticated clients to revoke any other client's key. Attackers can"}