CVE-2026-74871
Medium · 6.2CVSS
6.2
EPSS
0.1%
Published
Aug 17, 2026
CISA due date
—
The record
openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no prior hashing stage, attackers can bypass memory-hard key derivation and perform offline password cracking at SHA-256 speed instead of the configured KDF cost.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-112026 A security vulnerability has been detected in light0011 cms… CWE-916
- CVE-2026-86670 A flaw has been found in aircheng-org iWebShop-5 up to 5.15. CWE-916
- CVE-2026-81704 openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the… CWE-916
- CVE-2026-81689 openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted… CWE-916
- CVE-2026-75112 A security issue exists within OTTO® Fleet Manager. CWE-916
- CVE-2026-49005 The root password hash of the device can be obtained through unencrypted information in… CWE-916
- CVE-2026-55069 Kestra is an open-source, event-driven orchestration platform. CWE-916
- CVE-2026-56272 Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32… CWE-916