Threat Intelligence Database

CVE-2026-74874 is a high-severity vulnerability in jahlives openssl_encrypt versions before 1.4.0. The vulnerability arises because the software uses Python's non-cryptographic random module (Mersenne Twister) for steganographic pixel selection in the generate_pseudorandom_sequence function. An attacker who knows the password can recover the internal state of the PRNG from about 624 outputs, allowing prediction of pixel locations containing hidden data, facilitating extraction.

A high-severity information exposure vulnerability exists in jahlives openssl_encrypt versions up to 1.4.7. Diagnostic commands 'hsm fido2-test' and 'hsm onlykey-test' print the full derived hardware pepper as hex to stdout/stderr, which can be captured in terminal scrollback, session recordings, or CI logs. The leaked pepper is derived from a random per-invocation test salt and cannot be used to decrypt real files. The issue was fixed in versions 1.4.8 and 1.5.0 by removing these hex dumps and routing debug output through a redaction layer.