Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

OpenSSL TOTP Rate Limiter Not Shared Across Workers, Lost on Restart

CVE-2026-74878 · published 1 month ago
Summary

The OpenSSL TOTP rate limiter doesn't share its state across multiple workers or save its state when the server restarts, making it vulnerable to brute-force attacks. This can allow an attacker to try many combinations quickly without being detected. To fix this, you should use a shared storage solution like Redis or a database to store the rate limit state, or implement a shared-memory approach for multi-worker deployments.

What to do
  • Update tobi openssl-encrypt to version 1.4.0.
  • Update jahlives openssl_encrypt to version 1.4.0 or later.
Affected software
Ecosystem VendorProductAffected versions
pip tobi openssl-encrypt < 1.4.0
Fix: upgrade to 1.4.0
– jahlives openssl_encrypt < 1.4.0
Original advisory text
openssl_encrypt before 1.4.0 TOTP Rate Limiter Bypass
openssl_encrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate limiting protections.
References
Severity
9.3 Critical
CVSS 4.0: 9.1 (GHSA)
CVSS 3.1: 9.8 (NVD)
CVSS 4.0: 9.3 (NVD)
Exploitation
EPSS <1%
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published17 Aug 2026
Updated27 Sep 2026
First seen1 Apr 2026
Sources
CVE-2026-74878 · NVD
CVE-2026-74878 · MITRE
GHSA-h45m-mgcp-q388 · GHSA
CVE-2026-74878 · OSV
Track software like this
Free during beta