CVE-2026-74890 is a direct authentication bypass in the Camellia cipher implementation, and the attack vector is embarrassingly simple: set the environment variable PYTEST_CURRENT_TEST to any value, and HMAC integrity verification is disabled entirely. If you have any code execution capability in the process, you can send unauthenticated ciphertext that the decrypt function will process without complaint. The CVSS of 5.5 undersells this in contexts where it matters.
The variable in question is set by the pytest test runner to signal that code is executing in a test context. Somewhere in the codebase, someone added conditional logic checking this variable to bypass HMAC operations—likely to speed up tests or simplify test vector generation. The problem: that check made it into production paths. The result is that the authentication layer Camellia users rely on isn't a security feature they've opted into; it's a feature that can be toggled off by any attacker with environment variable access.
What should concern you most isn't the bug itself—it's the architectural choice that made it possible. HMAC integrity was implemented as a conditional feature dependent on process environment rather than as an invariant enforced at the module boundary. This means the authentication guarantee is only as strong as your environment isolation, which is a fragile foundation when containers, CI/CD pipelines, and shared hosting expose environment state broadly.
Prioritise remediation if you use this Camellia implementation in any system where integrity matters—particularly financial settlement, Japanese government integrations, or anywhere with regulatory authentication requirements. Those verticals have slower patching cycles, which means this vulnerability's effective exposure window is longer than the EPSS score suggests.
Audit your codebase for other environment-variable-driven security toggles. The pattern of conditional authentication logic based on process environment is a known failure mode across crypto libraries. The question isn't just whether this specific bypass exists—it's whether your security invariants are parameterized by state an attacker can control.