CVE-2026-74881
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
openssl_encrypt versions before 1.4.0 configure CORS with allow_origins set to wildcard and allow_credentials enabled to true. Attackers can create malicious websites that make authenticated cross-origin requests to the API on behalf of any user who visits them.
Risk Assessment
Users may be tricked into performing unauthorized actions in the API, potentially leading to data breaches or unauthorized operations.
Recommendation
Update openssl_encrypt to version 1.4.0 or later and configure CORS with specific allowed origins and disable allow_credentials if not necessary.
Original NVD description (English source)
openssl_encrypt versions before 1.4.0 configure CORS with allow_origins set to wildcard and allow_credentials enabled to true. Attackers can create malicious websites that make authenticated cross-origin requests to the API on behalf of any user who visits them.