Vulnerabilidades de Jahlives

CVE-2026-74881 Crítica · 9.3 CWE-942 17/08/2026

Jahlives openssl_encrypt anterior à 1.4.0: CORS mal configurado com origens curinga

As versões do openssl_encrypt anteriores à 1.4.0 configuram CORS com allow_origins definido como curinga e allow_credentials habilitado como verdadeiro. Atacantes podem criar sites maliciosos que fazem requisições autenticadas entre origens para a API em nome de qualquer usuário que os visitar.

CVE-2026-74880 Crítica · 9.8 CWE-598 17/08/2026

openssl_encrypt before 1.4.0 Token Leakage via Query Parameters

openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.

CVE-2026-74879 Alta · 7.5 CWE-209 17/08/2026

openssl_encrypt before 1.4.0 Information Disclosure via /ready endpoint

openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.

CVE-2026-74878 Crítica · 9.8 CWE-770 17/08/2026

Contorno do limitador de taxa TOTP no openssl_encrypt

Versões do openssl_encrypt anteriores à 1.4.0 usam um limitador de taxa em memória para a proteção contra força bruta de TOTP que não é compartilhado entre workers e é perdido com a reinicialização do servidor. Atacantes podem distribuir tentativas de autenticação entre várias instâncias do servidor ou tentar novamente imediatamente após uma reinicialização para contornar as proteções de limitação de taxa.

CVE-2026-74877 Alta · 8.8 CWE-639 17/08/2026

openssl_encrypt before 1.4.0 Missing Ownership Verification via revoke_key

openssl_encrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revoke_key method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership restriction.

CVE-2026-74876 Crítica · 9.8 CWE-347 17/08/2026

openssl_encrypt anterior à 1.4.0: bundles de chaves sem verificação de assinatura

As versões do openssl_encrypt anteriores à 1.4.0 contêm uma vulnerabilidade em PublicKeyBundle.from_dict() que cria bundles de chaves a partir de dados não confiáveis sem verificar assinaturas. Atacantes podem chamar from_dict() seguido de to_identity() sem verificação de assinatura para criptografar dados usando chaves públicas controladas pelo atacante, vazando segredos.

CVE-2026-74875 Crítica · 9.8 CWE-345 17/08/2026

openssl_encrypt before 1.4.0 Schema Validation Bypass

openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.

CVE-2026-74874 Alta · 7.5 CWE-338 17/08/2026

openssl_encrypt before 1.4.0 Weak PRNG Steganography Pixel Selection

openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generate_pseudorandom_sequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations containing hidden data for extraction.

CVE-2026-74873 Média · 5.5 CWE-214 17/08/2026

openssl_encrypt before 1.4.0 Password Exposure via CLI Argument

openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plaintext passwords and keystore passwords.

CVE-2026-74872 Crítica · 9.8 CWE-426 17/08/2026

openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool

openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.