CVE-2026-74893: openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded Secrets
opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.0 - Compensating control
Use a hardened JWT signing configuration: remove/replace any hardcoded default JWT signing secrets in config.py so forged JWT tokens cannot be validated (openssl_encrypt versions before 1.4.0 use hardcoded default secrets in config.py).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74893?
The severity of CVE-2026-74893 is rated as high with a score of 8.8.
How do I fix CVE-2026-74893?
To fix CVE-2026-74893, upgrade OpenSSL_encrypt to version 1.4.0 or later, where the hardcoded JWT secrets are removed.
What is the risk associated with CVE-2026-74893?
The risk associated with CVE-2026-74893 is that attackers can forge valid JWT tokens and gain unauthorized access to keyserver and telemetry APIs.
Who is affected by CVE-2026-74893?
CVE-2026-74893 affects users of OpenSSL_encrypt versions prior to 1.4.0 who utilize JWT tokens.
What can attackers do with CVE-2026-74893?
Attackers with access to the source code can exploit CVE-2026-74893 to create forged JWT tokens for any client_id.