External risk intelligence

OpenSSL Encrypt Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-74894

The vulnerability exists in an API authentication function that processes Bearer tokens from authorization headers. As this component is designed to manage and validate token-based access, it is inherently internet-facing in standard deployments where APIs are exposed to external clients.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects a component used for data encryption that incorrectly handles authentication tokens, allowing unauthorized access and actions. It poses a significant risk by potentially enabling attackers to bypass security controls and manipulate sensitive data. The main concern is confirming if this technology is in use and if it is exposed to potential threats.

Authentication bypass allows unauthorized access.
Vital for protecting sensitive digital assets.
Confirm relevance and exposure across the organization.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication by sending any non-empty Bearer token in the Authorization header to the `verify_api_token` function. This allows them to upload arbitrary public keys, discover all existing keys, and revoke any user's keys.

No specific access required.
Triggered by sending a forged token.
Enables unauthorized key management.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to bypass API authentication when a non-empty Bearer token is provided in the Authorization header. When supported by the advisory, this could lead to unauthorized access and manipulation of sensitive information or system functions.

API authentication tokens.
Uploading arbitrary public keys.
Unauthorized key management.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects the `openssl_encrypt` component's `verify_api_token` function. Application owners or platform teams are likely responsible for managing this component. The first step is to identify all instances of this software, confirm their exposure and business criticality, and then assign ownership for remediation planning.

Identify and assign accountable owners.
Verify affected assets and exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is openssl_encrypt?

The openssl_encrypt component is a software utility designed to manage data encryption processes and handle security-related operations, such as API token validation. It is typically integrated into applications to provide secure key management, allowing systems to authenticate clients and protect sensitive information by controlling how access tokens and public keys are processed.

What does CVE-2026-74894 mean for security?

This vulnerability is an authentication bypass, classified as CWE-287. It means the software fails to properly verify the identity of a requester. Specifically, the system incorrectly accepts any non-empty character string as a valid Bearer token, effectively treating unauthorized visitors as authenticated users who can then manipulate security keys without permission.

How is this vulnerability triggered?

An attacker triggers this bug by sending an HTTP request containing any non-empty text in the Authorization header. If the header contains data, the verify_api_token function fails to perform actual validation. The vulnerability is not triggered if the header is completely absent or empty; the flaw specifically resides in the flawed logic that trusts any provided token string.

Is my system at risk from this vulnerability?

According to Halo Surface Signal, this vulnerability is very likely to be reachable if your application exposes API endpoints to the internet. Because the affected function is designed to process and validate token-based access from external sources, any deployment that relies on this component for public-facing API authentication should be considered exposed.

What steps should I take if I use this software?

First, locate all instances of the openssl_encrypt component within your environment to determine where it is actively deployed. Once identified, evaluate if those specific services are reachable from external networks. Finally, coordinate with your development or platform teams to prioritize updates and ensure your API authentication logic is no longer reliant on the vulnerable function.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.