CVE-2026-74894

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.0

Description An authentication bypass exists in the verify api token() function, which accepts any non-empty Bearer token string without proper validation. This allows attackers to provide any Bearer token in the Authorization header to upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user.

Recommendations Update to version 1.4.0 or later. As a temporary workaround, restrict access to the verify api token() function to minimize the risk of exploitation.