CVE-2026-74871
openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out duri
CVSS
6.2
Medio
EPSS
0.1%
p1
KEV
—
Exploit Today
0
0-100
Publicado: 17 ago 2026 · Última mod.: 10 sept 2026 · CWE-916
0.1%EPSS · 30 días0.1%
2026-10-042026-10-31
openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no prior hashing stage, attackers can bypass memory-hard key derivation and perform offline password cracking at SHA-256 speed instead of the configured KDF cost.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-13576—1.0%
——0CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes.
Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing.
An attacker who obtains the user table can recover passwords by fast offline guessing.3dCVE-2026-118991—1.0%
——0CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key.
getCrypt() pads the backup password with "x" characters and cuts it to 32 bytes to form the AES key, with no salt and no key derivation. The first block of a backup holds a 16 hex digit length field, so decrypting one block confirms a password guess at raw AES speed.
An attacker who obtains a backup can recover its password by fast offline guessing, and with it every credential the backup holds.3dCVE-2026-65629—0.0%
——0Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack.
When jose exports a password-encrypted private key with jose_jwk:to_der/2 (JOSE.JWK.to_der/2), the jose_jwk_der:to_binary/3 function in src/jwk/jose_jwk_der.erl serializes the key as a PKCS#8 EncryptedPrivateKeyInfo using the PBES2 scheme with hardcoded key-derivation parameters: PBKDF2-HMAC-SHA256 with an iteration count of 2048 and an 8-byte (64-bit) random salt. Neither value can be overridden by the caller.
Both values are far below current guidance (OWASP recommends on the order of 600,000 iterations for PBKDF2-HMAC-SHA256, and NIST recommends salts of at least 128 bits), so the key-stretching work factor is roughly 300 times lower than intended and the short salt reduces the cost of precomputation across keys. The symmetric encryption (AES-256-CBC with a 16-byte random IV) is not affected; the weakness is entirely in the derivation strength. An attacker who obtains one of these exported blobs (for example from a backup, configuration repository, object storage, or logs) can mount a cheap offline dictionary or brute-force attack against the export password, and success yields the full private key.
This issue affects jose: from 1.10.0 before 1.11.13.6dCVE-2026-1160542.2 BAJ11.4%
——3A security vulnerability has been detected in SH3. This affects an unknown function of the component Módulo de Gestão/Módulo de Arrecadação. The manipulation leads to password hash with insufficient computational effort. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.0.2.0 mitigates this issue. Upgrading the affected component is recommended.3dCVE-2026-1160715.9 MED10.0%
——3rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessing and decrypt the database containing exchange API keys, secrets, wallet addresses and transaction history.4dCVE-2025-30049—11.1%
——3The CGM CLININET application stores user passwords as unsalted MD5 hashes.
This issue was fixed in versions 2026.MS1 and 2026.MS35d