CVE-2026-74890: openssl_encrypt before 1.4.0 HMAC Authentication Bypass via Environment Variable
opensslencrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTESTCURRENTTEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticated ciphertext and bypass integrity protection on encrypted data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.0 - Configuration
Ensure the environment variable PYTEST_CURRENT_TEST is not set; specifically, in vulnerable openssl_encrypt versions before 1.4.0, setting PYTEST_CURRENT_TEST disables HMAC tag generation and verification in CamelliaCipher.
OpenSSL CamelliaCipher (via PHP openssl_encrypt) PYTEST_CURRENT_TEST = unset/empty
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74890?
CVE-2026-74890 has a medium severity score of 5.5.
How do I fix CVE-2026-74890?
To fix CVE-2026-74890, upgrade to OpenSSL version 1.4.0 or later.
What version of OpenSSL is affected by CVE-2026-74890?
CVE-2026-74890 affects OpenSSL versions before 1.4.0.
What type of vulnerability is CVE-2026-74890?
CVE-2026-74890 is an authentication bypass vulnerability.
What environment variable is associated with CVE-2026-74890?
CVE-2026-74890 is associated with the PYTEST_CURRENT_TEST environment variable.