Threats tagged 'ghsa-crfx-7r98-6r44'

CVE-2026-74878 is a critical vulnerability in jahlives openssl_encrypt versions before 1.4.0. The vulnerability arises from an in-memory rate limiter used for TOTP brute-force protection that is not shared across server workers and resets on server restart. This allows attackers to bypass rate limiting by distributing authentication attempts across multiple server instances or retrying immediately after a restart.