AES-GCM Fallback Authentication Bypass in OpenSSL Encrypt

CVE-2026-74901 is a critical authentication bypass vulnerability in openssl_encrypt versions before 1.4.0 that exploits insecure cryptographic fallback behavior. When AES-GCM decryption fails, the library silently downgrades to unauthenticated AES-CTR mode, eliminating integrity verification. This affects any application using openssl_encrypt for authenticated encryption—particularly those handling sensitive data requiring tamper detection. Attackers can intercept encrypted communications and modify ciphertext in transit, performing bit-flipping attacks that succeed without triggering authentication errors. The 9.8 CVSS score reflects the ease of exploitation and severe impact on confidentiality and integrity.

While this CVE currently maps to zero MITRE ATT&CK techniques, Casky's Claude-powered analysis would identify attack patterns associated with T1040 (Traffic Capture), T1565 (Data Manipulation), and T1187 (Forced Authentication) by correlating behavioral indicators: unexplained AES-CTR usage in encrypted channels, decryption errors followed by successful processing, and modification of ciphertext blocks without integrity validation failures. Practitioners using Casky would detect these anomalies through security skill evaluation, revealing when applications fall back to weaker cipher modes and flag communications lacking proper authentication enforcement—critical for identifying exploitation attempts targeting cryptographic implementations.