by Kastro
Paper/Archive/CVE-2026-81702

CVE-2026-81702

jahlives openssl_encrypt — openssl_encrypt before 1.4.9 Key Substitution via Identity Load

EPSS 0.2%CVSS 9.8
critical.is priorityof 100
31
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 8.3.083 × 201.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.

Affected

ProductAffectedFixed inSource
openssl_encrypt< 1.4.91.4.9CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorygithub.com/jahlives/openssl_encrypt/security/advisories/GHSA-q8p3-7h6h-ghfrwriteupvulncheck.com/advisories/openssl-encrypt-before-1.4.9-key-substitution-via-identity-load