Description

openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify ciphertext in transit to bypass integrity verification and perform bit-flipping attacks without detection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-17T11:16:45.183Z",
  "pubdate": "2026-08-17T11:16:45.183Z",
  "executiveSummary": "An authentication bypass vulnerability exists in openssl_encrypt versions prior to 1.4.0 within the pqc.py module. The flaw stems from improper handling of cryptographic decryption failures, specifically when AES-GCM decryption encounters an error and improperly falls back to unauthenticated AES-CTR mode. This critical security oversight allows remote attackers capable of intercepting and modifying network traffic to bypass integrity verification mechanisms entirely. By tampering with ciphertexts in transit, threat actors can execute successful bit-flipping attacks without triggering detection or alerting security controls. The impact of this vulnerability includes the complete loss of confidentiality and integrity for protected data streams, enabling malicious manipulation of application logic or data payloads. Affected systems include any deployment utilizing vulnerable versions of the library for cryptographic operations involving post-quantum cryptography wrappers or related implementations in pqc.py. Exploitation requires the ability to intercept, manipulate, and forward network traffic between communicating parties. Given the severity of integrity violations and the ease of executing chosen-ciphertext or bit-flipping manipulations once the fallback is triggered, the risk implications are severe, demanding immediate remediation to prevent unauthorized data tampering and potential privilege escalation or state corruption.",
  "technicalDetails": "The vulnerability resides within the pqc.py component of openssl_encrypt versions prior to 1.4.0, specifically in the logic governing cryptographic decryption routines. The root cause of the flaw is a catastrophic cryptographic design error where failures in authenticated encryption modes—specifically AES-GCM—do not securely abort the decryption process and raise an unhandled exception. Instead, the implementation incorporates an insecure fallback mechanism that diverts execution flow to unauthenticated AES-CTR mode upon encountering a decryption or authentication tag verification failure.\nAES-GCM (Galois/Counter Mode) provides both confidentiality and cryptographic integrity through the use of an authentication tag. When a ciphertext is modified in transit, the authentication tag verification inherently fails, signaling tampering. However, due to the flawed implementation in pqc.py, this failure condition is intercepted and incorrectly handled by falling back to AES-CTR, which lacks any built-in message authentication code or integrity verification capabilities.\nThe attack flow proceeds as follows: First, an attacker intercepts encrypted network traffic passing between vulnerable endpoints. Second, the attacker modifies the ciphertext bytes in transit, anticipating that the receiving system will attempt decryption. Third, when the receiving application utilizes the vulnerable openssl_encrypt implementation in pqc.py, the initial attempt to decrypt using AES-GCM fails due to the modified ciphertext corrupting the expected authentication tag. Fourth, rather than terminating the session and securely discarding the payload, the vulnerable code path triggers the fallback mechanism and processes the modified data using unauthenticated AES-CTR mode. Fifth, because AES-CTR simply applies keystream XOR operations without verifying integrity, the modified bits are successfully translated into predictable plaintext alterations, effectively enabling a classic bit-flipping attack.\nNo authentication or specific privilege levels are required by the attacker against the target application to initiate this exploit, provided they possess network positioning to intercept and alter data payloads in transit. The network exposure is directly tied to any service or application importing and executing the vulnerable functions within pqc.py to process untrusted or externally supplied ciphertexts. The post-exploitation impact includes unauthorized modification of decrypted data, potential bypass of security controls, injection of malicious payloads into memory or application workflows, and full compromise of data integrity without leaving cryptographic audit trails of the tampering."
}