Hardcoded JWT Signing Secrets in openssl_encrypt

The openssl_encrypt Python library, specifically versions prior to 1.4.0, contains hardcoded default JWT signing secrets within the 'config.py' file. This flaw allows attackers to derive the secret used for signing authentication tokens. By leveraging the known secret, an unauthorized actor can forge valid JWT tokens for any client_id. Successfully forging these tokens grants the attacker authenticated access to sensitive backend services, including keyserver and telemetry APIs, bypassing standard identity and access management controls. This vulnerability (CVE-2026-74893) is classified as a 'Use of Hard-coded Credentials' (CWE-798) and requires immediate remediation by upgrading to version 1.4.0 or higher.

Impact

The vulnerability poses a high risk to systems utilizing openssl_encrypt for authentication or telemetry data processing. Unauthorized access via forged tokens could result in the exfiltration of sensitive telemetry data, compromise of cryptographic keys handled by the keyserver API, and full identity impersonation within the application environment.

Recommendation

• Upgrade the 'openssl_encrypt' package to version 1.4.0 or later immediately to remove the hardcoded secret.
• Review all JWT tokens issued or validated by applications using 'openssl_encrypt' prior to the upgrade for signs of suspicious or unauthorized client_id generation.
• Rotate all secrets and cryptographic material associated with the affected keyserver and telemetry APIs if there is evidence that the hardcoded secret was exposed or exploited.