Critical Vulnerabilities in OpenSSL: CVE-2026-74880 and CVE-2026-74888

Two critical vulnerabilities, CVE-2026-74880 and CVE-2026-74888, were published on August 17, 2026, affecting OpenSSL versions prior to 1.4.0. CVE-2026-74880 allows attackers to extract sensitive refresh tokens from URL query parameters, potentially leading to unauthorized access. CVE-2026-74888 involves a weak PBKDF2 key derivation method, making it easier for attackers to crack passwords protecting legacy encrypted files. No specific affected products have been listed yet. Both vulnerabilities are associated with significant weaknesses in cryptographic practices. Security professionals are urged to monitor for potential exploits and implement mitigations as they become available. The vulnerabilities have been documented on GitHub, indicating a risk of proof-of-concept exploits emerging soon.

Key Points: • CVE-2026-74880 exposes refresh tokens via URL query parameters, risking unauthorized access. • CVE-2026-74888 features a weak PBKDF2 key derivation method, making password cracking easier. • No specific affected products have been identified, but both vulnerabilities are critical.