CVE-2026-74881 — openssl_encrypt before 1.4.0 CORS Misconfiguration via Wildcard Origins

Affected: jahlives openssl_encrypt

openssl_encrypt versions before 1.4.0 configure CORS with allow_origins set to wildcard and allow_credentials enabled to true. Attackers can create malicious websites that make authenticated cross-origin requests to the API on behalf of any user who visits them.

GHSA-c65f-x25w-62jv — openssl-encrypt has CORS wildcard with allow_credentials=True in standalone servers

Affected: PyPI: openssl-encrypt

### Summary

Both standalone servers configure CORS with `allow_origins=["*"]`, `allow_credentials=True`, `allow_methods=["*"]`, and `allow_headers=["*"]`.

### Affected Code

```python # server/key-server/app/main.py:86-92 # server/telemetry-server/app/main.py:23-29 app.add_middleware( CORSMiddleware, allow_origins=settings.cors_origins, # defaults to ["*"] allow_credentials=True, allow_methods=["*"], allow_headers=["*"], ) ```

The docker-compose file (`openssl_encrypt_server/docker-compose.yml:75`) also defaults `CORS_ORIGINS` to `*`, and `.env.example` ships with `CORS_ORIGINS=*`.

### Impact

This is the most permissive CORS configuration possible, allowing any website to make fully credentialed cross-origin requests to the API. An attacker's website could make authenticated API calls on behalf of any user who visits it.

### Recommended Fix

- Remove wildcard defaults — require explicit origin configuration - Never combine `allow_origins=["*"]` with `allow_credentials=True` - Update `.env.example` with placeholder domains instead of `*`

### Fix

Fixed in commit `809416b` on branch `releases/1.4.x` — changed CORS default from ["*"] to [] in both key-server and telemetry-server; added validation rejecting wildcard when debug=False.

Most recent entries from all

CVE-2026-74881 — openssl_encrypt before 1.4.0 CORS Misconfiguration via Wildcard Origins

GHSA-c65f-x25w-62jv — openssl-encrypt has CORS wildcard with allow_credentials=True in standalone servers