CVE-2026-74878
Critical · CVSS 9.8- CVSS
- 9.8
- nvd
- EPSS
- 0.75%
- 53th pct
- KEV
- No
- Class
- oss containerizable
- CWE-770
Description
openssl_encrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate limiting protections.
Affected packages
| PyPI | openssl-encrypt | 0 → 1.4.0 |
References
Status: profiled · ingested 2026-09-01T18:00:49.000Z