CVE-2026-74876 is a vulnerability in jahlives openssl_encrypt prior to version 1.4.0 where the PublicKeyBundle.from_dict() method does not verify cryptographic signatures when creating key bundles from untrusted input. Attackers can exploit this by invoking from_dict() followed by to_identity() without signature verification, enabling encryption with attacker-controlled public keys and resulting in secret leakage. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

The vulnerability allows unauthenticated remote attackers to encrypt data using attacker-controlled public keys without signature verification, leading to potential leakage of sensitive secrets. This compromises confidentiality and integrity of encrypted data and can disrupt normal cryptographic operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Users should monitor the vendor's communications for updates and avoid using affected versions if possible until a fix is available.