Cvefeed Critical Vulnerabilities in OpenSSL: CVE-2026-74880 and CVE-2026-74888
Article Content
- •CVE-2026-74880 exposes refresh tokens via URL query parameters, risking unauthorized access.
- •CVE-2026-74888 features a weak PBKDF2 key derivation method, making password cracking easier.
- •No specific affected products have been identified, but both vulnerabilities are critical.
Two critical vulnerabilities, CVE-2026-74880 and CVE-2026-74888, were published on August 17, 2026, affecting OpenSSL versions prior to 1.4.0. CVE-2026-74880 allows attackers to extract sensitive refresh tokens from URL query parameters, potentially leading to unauthorized access. CVE-2026-74888 involves a weak PBKDF2 key derivation method, making it easier for attackers to crack passwords protecting legacy encrypted files. No specific affected products have been listed yet. Both vulnerabilities are associated with significant weaknesses in cryptographic practices. Security professionals are urged to monitor for potential exploits and implement mitigations as they become available. The vulnerabilities have been documented on GitHub, indicating a risk of proof-of-concept exploits emerging soon.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (4)
Following this threat?
Track CVE-2026-74880 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical Authentication Bypass in Rejetto HFS Exploited Within 24 Hours Anthropic's Mythos model identified a critical authentication bypass in Rejetto HTTP File Server (HFS), tracked as CVE-2026-61500, allowing remote code execution. Discovered by Horizon3 researcher Zach Hanley, the flaw was revealed on September 27, 2026, and exploitation began within 24 hours, with attacks traced to… 
Critical Citrix NetScaler Zero-Day Vulnerabilities Exploited In late September 2026, two critical zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) in Citrix NetScaler ADC and Gateway were actively exploited, allowing remote code execution. The Cybersecurity and Infrastructure Security Agency (CISA) added these CVEs to its Known Exploited Vulnerabilities catalog on…