{"id":"CVE-2026-74881","aliases":["GHSA-c65f-x25w-62jv","PYSEC-2026-3977"],"url":"https://o3.security/vulnerability/CVE-2026-74881","summary":"openssl_encrypt before 1.4.0 CORS Misconfiguration via Wildcard Origins","details":"### Summary\n\nBoth standalone servers configure CORS with `allow_origins=[\"*\"]`, `allow_credentials=True`, `allow_methods=[\"*\"]`, and `allow_headers=[\"*\"]`.\n\n### Affected Code\n\n```python\n# server/key-server/app/main.py:86-92\n# server/telemetry-server/app/main.py:23-29\napp.add_middleware(\n    CORSMiddleware,\n    allow_origins=settings.cors_origins,  # defaults to [\"*\"]\n    allow_credentials=True,\n    allow_methods=[\"*\"],\n    allow_headers=[\"*\"],\n)\n```\n\nThe docker-compose file (`openssl_encrypt_server/docker-compose.yml:75`) also defaults `CORS_ORIGINS` to `*`, and `.env.example` ships with `CORS_ORIGINS=*`.\n\n### Impact\n\nThis is the most permissive CORS configuration possible, allowing any website to make fully credentialed cross-origin requests to the API. An attacker's website could make authenticated API calls on behalf of any user who visits it.\n\n### Recommended Fix\n\n- Remove wildcard defaults — require explicit origin configuration\n- Never combine `allow_origins=[\"*\"]` with `allow_credentials=True`\n- Update `.env.example` with placeholder domains instead of `*`\n\n### Fix\n\nFixed in commit `809416b` on branch `releases/1.4.x` — changed CORS default from [\"*\"] to [] in both key-server and telemetry-server; added validation rejecting wildcard when debug=False.","published":"2026-08-17T11:04:47.698Z","modified":"2026-10-28T02:30:32.299310182Z","cvss":null,"epss":{"score":0.0025,"percentile":0.16382,"asOf":"2026-09-11"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"openssl-encrypt","fixedVersion":"1.4.0"}],"fix":{"url":"https://github.com/jahlives/openssl_encrypt/commit/809416b74d2749cdcffb484cd65b057e1685cc13","label":"jahlives/openssl_encrypt@809416b"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74881.json"},{"type":"ADVISORY","url":"https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-c65f-x25w-62jv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74881"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/openssl-encrypt-before-cors-misconfiguration-via-wildcard-origins"},{"type":"WEB","url":"https://github.com/jahlives/openssl_encrypt/commit/809416b74d2749cdcffb484cd65b057e1685cc13"},{"type":"PACKAGE","url":"https://github.com/jahlives/openssl_encrypt"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:32.299310182Z"}}