PYSEC-2026-3768
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/openssl-encrypt/PYSEC-2026-3768.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-3768
- Aliases
-
- CVE-2026-74893
- GHSA-qc6h-gfjh-7qqg
- Published
- 2026-08-17T11:16:44.397Z
- Modified
- 2026-09-02T09:00:05.229766701Z
- Severity
-
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
- Summary
- [none]
- Details
-
opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs.
- References
Affected packages
PyPI / openssl-encrypt
Package
- Name
- openssl-encrypt
- View open source insights on deps.dev
- Purl
- pkg:pypi/openssl-encrypt
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.4.0
Affected versions
0.*
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.3.0
0.3.1
0.3.2
0.3.3
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.5.0
0.5.1
0.5.3
0.6.0rc1
0.7.0rc2
0.7.1
0.7.2
0.8.0
0.8.1
0.8.2
0.9.2
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0b3
1.4.0b4
1.4.0b5
1.4.0b6
1.4.0b7
1.4.0b8