CVE-2026-74901

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.0

Description An authentication bypass exists in pqc.py where failures during AES-GCM decryption cause the system to fall back to unauthenticated AES-CTR mode. This allows attackers to modify ciphertext during transit to bypass integrity verification and execute bit-flipping attacks without detection. AES-GCM is an authenticated encryption mode that provides both confidentiality and authenticity, while AES-CTR is a stream cipher mode that does not provide built-in integrity checks.

Recommendations Update openssl encrypt to version 1.4.0 or later.