{
  "id": "CVE-2026-74889",
  "url": "https://spydr.io/cve/CVE-2026-74889",
  "published": "2026-08-17T11:16:43.803Z",
  "modified": "2026-09-01T15:26:32.637Z",
  "score": 9.3,
  "severity": "critical",
  "cvss_version": "4.0",
  "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
  "score_source": "vulncheck.com",
  "epss": 0.00348,
  "epss_percentile": 0.26091,
  "exploited": false,
  "kev": null,
  "ssvc_exploitation": "none",
  "vendors": [
    "jahlives"
  ],
  "products": [
    "jahlives openssl_encrypt"
  ],
  "cwes": [
    "CWE-326"
  ],
  "description": "openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks.",
  "status": "Analyzed",
  "score_type": "Secondary",
  "scores": {
    "cvss_v40": 9.3,
    "cvss_v31": 9.8,
    "cvss_v30": null
  },
  "references": [
    {
      "url": "https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-j9mh-57cc-665x",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.vulncheck.com/advisories/openssl-encrypt-before-weak-key-derivation-via-hkdf",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ],
  "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74889",
  "covered_in": [],
  "attribution": [
    {
      "source": "NVD",
      "url": "https://nvd.nist.gov",
      "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD."
    },
    {
      "source": "CISA KEV",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "notice": "Known exploited vulnerabilities from the CISA KEV catalog."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss",
      "notice": "Exploit prediction scores from FIRST EPSS."
    }
  ]
}