---
id: CVE-2026-74894
aliases:
  - PYSEC-2026-3769
  - GHSA-4g2c-wpgj-49w8
title: >-
  openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability
  in the verify_api_token function that accepts any non-empty …
summary: >-
  openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability
  in the verify_api_token function that accepts any non-empty Bearer token
  string without validation. Attackers can upload arbitrary public keys,
  enumerate all ke…
severity: none
vendor: openssl-encrypt
product: openssl-encrypt
ecosystem: pip
affected:
  - openssl-encrypt < 1.4.0
patched:
  - openssl-encrypt 1.4.0
published: '2026-08-17'
updated: '2026-09-02'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/PYSEC-2026-3769'
references:
  - url: >-
      https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-4g2c-wpgj-49w8
  - url: >-
      https://www.vulncheck.com/advisories/openssl-encrypt-before-authentication-bypass-via-bearer-token
tags:
  - osv
  - pip
epss: 0.00655
epssPercentile: 0.49211
ingestedAt: '2026-09-02T19:31:25.783Z'
---

## Overview

openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header.

## Affected packages

- `openssl-encrypt < 1.4.0`

## Remediation

Upgrade to a patched release:

- `openssl-encrypt 1.4.0`