Hardcoded JWT Signing Secrets in openssl_encrypt

hello@craftedsignal.io — Mon, 17 Aug 2026 12:50:36 +0000

The openssl_encrypt Python library, specifically versions prior to 1.4.0, contains hardcoded default JWT signing secrets within the 'config.py' file. This flaw allows attackers to derive the secret used for signing authentication tokens. By leveraging the known secret, an unauthorized actor can forge valid JWT tokens for any client_id. Successfully forging these tokens grants the attacker authenticated access to sensitive backend services, including keyserver and telemetry APIs, bypassing standard identity and access management controls. This vulnerability (CVE-2026-74893) is classified as a 'Use of Hard-coded Credentials' (CWE-798) and requires immediate remediation by upgrading to version 1.4.0 or higher.

Impact

The vulnerability poses a high risk to systems utilizing openssl_encrypt for authentication or telemetry data processing. Unauthorized access via forged tokens could result in the exfiltration of sensitive telemetry data, compromise of cryptographic keys handled by the keyserver API, and full identity impersonation within the application environment.

Recommendation

Upgrade the 'openssl_encrypt' package to version 1.4.0 or later immediately to remove the hardcoded secret.
Review all JWT tokens issued or validated by applications using 'openssl_encrypt' prior to the upgrade for signs of suspicious or unauthorized client_id generation.
Rotate all secrets and cryptographic material associated with the affected keyserver and telemetry APIs if there is evidence that the hardcoded secret was exposed or exploited.

Arbitrary Code Execution in openssl_encrypt Library

hello@craftedsignal.io — Mon, 17 Aug 2026 12:46:09 +0000

The openssl_encrypt Python package, specifically versions prior to 1.4.0, contains an arbitrary code execution vulnerability (CVE-2026-74872) located within its Whirlpool hash implementation. The library attempts to load shared object (.so) modules using overly broad glob patterns without performing any integrity or authenticity checks. An attacker capable of writing files to the Python site-packages directory can place a malicious shared object file that matches the pattern 'whirlpoolpy313.so'. When the openssl_encrypt library is imported or the specific hash function is invoked, the Python interpreter loads the malicious .so file, resulting in native code execution under the context of the running process. This issue is categorized as CWE-426: Untrusted Search Path.

Impact

The vulnerability carries a CVSS v3.1 score of 9.8 (Critical). Successful exploitation allows unauthenticated remote or local attackers to achieve arbitrary code execution on systems where the library is present and the site-packages directory is writable. This exposes applications to full system compromise, data theft, and persistence, particularly in environments where automated installers or CI/CD pipelines might inadvertently grant attackers write access to site-packages.

Recommendation

Upgrade the 'openssl_encrypt' package to version 1.4.0 or later across all Python environments.
Audit existing Python site-packages directories for any files matching the pattern 'whirlpoolpy313.so' that were not installed by the official package manager.
Implement file integrity monitoring on Python library installation paths to detect unauthorized creation of .so files.
Enforce strict file system permissions on 'site-packages' directories to prevent non-privileged users from modifying or adding library files.

Openssl_encrypt (< 1.4.0) - CraftedSignal Threat Feed

Hardcoded JWT Signing Secrets in openssl_encrypt

Impact

Recommendation

Arbitrary Code Execution in openssl_encrypt Library

Impact

Recommendation