CVE Intelligence
Analysis AI-assisted

CVE-2026-74878: openssl_encrypt TOTP Rate Limiter Bypass

CVE-2026-74878 affects openssl_encrypt versions before 1.4.0, where the TOTP brute-force protection uses an in-memory rate limiter. That limiter is not shared across workers and is lost on server restart, so the protection can be bypassed. VulnCheck rates it CVSS 3.1 9.8 (Critical), and the record reports no confirmed exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-74878 was published by the VulnCheck CNA and concerns the openssl_encrypt project (Jahlives Openssl Encrypt) in versions before 1.4.0. According to the record, its TOTP brute-force protection relies on an in-memory rate limiter that is not shared across workers and is reset when the server restarts.

Impact

The record states that an attacker can spread authentication attempts across several server instances, or retry immediately after a restart, to get around the rate limiting. The weakness is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). VulnCheck assigns CVSS 3.1 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and the record also lists CVSS 4.0 9.3.

Affected products and versions

  • Jahlives Openssl Encrypt, versions < 1.4.0
  • The record does not name a specific patched release. The fix entry is typed as mitigation and points to the vendor advisory.

Exploitation status

  • The CVE is not listed in the CISA KEV catalog.
  • The SSVC exploitation field is recorded as none.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Review vendor advisory GHSA-h45m-mgcp-q388 and apply the mitigation it describes.
  • Plan an upgrade to a release that the vendor confirms as fixed, which is expected to be 1.4.0 or later; verify the exact version against the vendor's release notes.
  • Until then, do not rely only on per-process throttling for TOTP. Add defense in depth, such as centralized and persistent rate limiting at the authentication layer or at the edge.

Detection guidance

  • Monitor authentication logs for unusual volumes of TOTP failures, especially ones spread across accounts, source addresses, nodes or time windows.
  • Watch for bursts of failures right after service restarts or deployments.
  • Correlate failed attempts across all instances instead of counting per node.

Limitations of the available information

  • The record does not identify the exact patched release or its date.
  • It does not state whether the vendor mitigation fully removes the weakness or only reduces it.
  • The EPSS entry is dated after the publication date; its timing relative to the advisory cannot be confirmed from the record.
  • No public proof-of-concept or third-party exploitation report is cited in the record.

Frequently asked questions

Which versions of openssl_encrypt are affected?

The record lists Jahlives Openssl Encrypt versions before 1.4.0 as affected.

Is this vulnerability being exploited in the wild?

The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do now?

Review vendor advisory GHSA-h45m-mgcp-q388, plan an upgrade to a release confirmed as fixed, and add centralized, persistent rate limiting and log monitoring for TOTP failures.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.