CVE-2026-74881

CVE-2026-74881 describes a CORS misconfiguration in the openssl_encrypt library where allow_credentials is set to true alongside a wildcard origin, a combination browsers explicitly reject under the CORS specification. This is a known anti-pattern with documented history dating to the spec's adoption, yet it continues to surface in library code — a failure of API design and documentation rather than simple negligence. The CVSS 6.5 rating is misleading for this class of vulnerability. Library-origin CORS flaws create exposure that scales with the dependency graph, not with exploit sophistication. The openssl_encrypt naming itself is a critical concern: this is not the OpenSSL project, and whether the name reflects legitimate but unfortunate naming, confusion marketing, or something more adversarial determines the entire remediation pathway. Before treating this as a standard patching exercise, verify the actual package publisher and map its downstream dependents. The EPSS score of 0.0028 compounds the problem. Scoring models treat vulnerabilities as discrete events, not as inherited states sitting dormant in dependency trees. A library with this flaw sits silently in thousands of projects, activating only when an attacker crafts a malicious page — no targeting required, just a user who visits a site while authenticated to any downstream consumer. This isn't a vulnerability that waits to be exploited; it's exposure that exists by default across the library's install base. Practitioner priority: determine whether openssl_encrypt has a responsive maintainer. If this is an abandoned package or a namespace confusion artifact, the remediation pathway may not exist through normal channels. Treat the dependency graph mapping as urgent — identify which of your dependencies pull this library transitively, because the lockfile sediment persists indefinitely. Vulnerable versions remain downloadable and hash-verifiable long after a patch is released. The blast radius isn't measured in current downloads; it's measured in downstream projects that will never update. The medium severity rating will cause organizational triage systems to deprioritize this. Resist that instinct. The flaw is trivial to exploit but structurally dangerous in aggregate — exactly the category where a modest technical severity hides a systemic supply chain risk that compounds over time.

Reviewed through automated stages and approved by a human before publication.