CVE-2026-74881: openssl_encrypt before 1.4.0 CORS Misconfiguration via Wildcard Origins
opensslencrypt versions before 1.4.0 configure CORS with alloworigins set to wildcard and allowcredentials enabled to true. Attackers can create malicious websites that make authenticated cross-origin requests to the API on behalf of any user who visits them.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.0 - Configuration
For versions before 1.4.0, change CORS configuration to avoid wildcard origins (do not set allow_origins to '*') and do not enable allow_credentials=true with wildcard origins.
openssl_encrypt allow_origins = not wildcard (*)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74881?
The severity of CVE-2026-74881 is medium with a score of 6.5.
How do I fix CVE-2026-74881?
To fix CVE-2026-74881, upgrade OpenSSL to version 1.4.0 or later.
What systems are affected by CVE-2026-74881?
CVE-2026-74881 affects OpenSSL versions prior to 1.4.0 that improperly configure CORS.
What type of vulnerability is CVE-2026-74881?
CVE-2026-74881 is a cross-origin resource sharing (CORS) misconfiguration vulnerability.
What attacks can exploit CVE-2026-74881?
CVE-2026-74881 can be exploited by attackers creating malicious websites that make authenticated requests to the API.