jahlives/openssl_encrypt Security Advisories | GitStock

medium2026-04-01

openssl-encrypt has CORS wildcard with allow_credentials=True in standalone servers

GHSA-c65f-x25w-62jv

medium2026-04-01

openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage

GHSA-4rh7-jwg9-m28m

medium2026-04-01

openssl-encrypt's readiness endpoint leaks database error details to unauthenticated callers

GHSA-2vhw-q7vh-7xv2

medium2026-04-01

openssl-encrypt has no owner verification on key revocation — any client can revoke any key

GHSA-hvc7-763r-4f3h

medium2026-04-01

openssl-encrypt's unverified key bundle from_dict() + to_identity() path allows encryption to attacker keys

GHSA-8h88-gxp3-j7pg

medium2026-03-31

openssl-encrypt silently skips schema validation when jsonschema library is not installed

GHSA-425g-fjhq-5h92

medium2026-03-31

openssl-encrypt has non-cryptographic PRNG used for steganography pixel selection

GHSA-vfgx-5q85-58q3

medium2026-03-31

openssl-encrypt has visible password in process list via --password CLI argument

GHSA-h3m5-p59h-x88p

critical2026-03-31

openssl-encrypt: TOTP rate limiter is in-memory only — not shared across workers, lost on restart

GHSA-h45m-mgcp-q388

medium2026-03-31

openssl-encrypt: Dynamic .so loading for Whirlpool uses broad glob pattern without integrity verification

GHSA-j48q-4c78-rhf9