high8.8
CVE-2026-74893
openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks.
Impact
openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any client_id to gain authenticated access to keyserver and telemetry APIs.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jahlives | Openssl Encrypt | before 1.4.0 |