CVE-2026-74901 in openssl_encrypt
Summary
by MITRE • 08/17/2026
openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify ciphertext in transit to bypass integrity verification and perform bit-flipping attacks without detection.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/17/2026
The cryptographic library openssl_encrypt, specifically prior to version 1.4.0, contains a critical authentication bypass vulnerability located within the pqc.py module. This flaw stems from an improper error handling mechanism during the decryption process involving AES-GCM (Galois/Counter Mode). In secure implementations of authenticated encryption with associated data such as AES-GCM, any modification to the ciphertext or initialization vector should result in immediate verification failure and termination of the operation to preserve integrity. However, in this vulnerable version, when an authentication check fails during decryption, the system does not halt execution but instead triggers a fallback mechanism that switches to unauthenticated AES-CTR mode for subsequent operations within the same session context. This design flaw fundamentally undermines the security guarantees provided by authenticated encryption protocols.
The operational impact of this vulnerability is severe because it allows attackers to perform bit-flipping attacks on encrypted data without detection. Since AES-CTR mode provides confidentiality but no integrity or authenticity, an attacker who intercepts network traffic can modify specific bits in the ciphertext stream. When these modified packets are processed by the vulnerable library after a failed authentication attempt triggers the fallback, the system decrypts them as if they were valid. This enables precise manipulation of plaintext data, such as altering financial transaction amounts, changing user permissions, or injecting malicious code into application logic. The attacker does not need to know the encryption key because the vulnerability lies in the protocol state management rather than the cryptographic strength itself.
This type of flaw is classified under CWE-347: Improper Verification of Cryptographic Signature and aligns with MITRE ATT&CK technique T1590, which involves gathering victim information or manipulating data flows to bypass security controls. The root cause is a violation of the principle that cryptographic operations must be atomic regarding integrity checks; once authentication fails, no further processing should occur using potentially compromised state variables. The fallback behavior suggests an attempt at backward compatibility or performance optimization was implemented incorrectly, prioritizing availability over confidentiality and integrity. Such patterns are dangerous in high-assurance environments where data tampering can lead to significant financial loss or system compromise.
Mitigation strategies require immediate upgrading of the openssl_encrypt library to version 1.4.0 or later, which corrects the error handling logic by ensuring that authentication failures result in strict termination rather than fallback to weaker modes. If an upgrade is not immediately feasible, developers should implement explicit checks for decryption status before processing any output from AES-GCM operations and disable any automatic mode switching features within their application code. Additionally, implementing end-to-end integrity verification at the application layer using HMACs can provide a secondary defense mechanism against bit-flipping attacks even if lower-level cryptographic libraries are compromised. Regular security audits of cryptographic implementations should focus on error handling paths to ensure that failure states do not degrade into less secure operational modes.