CVE-2026-81702
openssl_encrypt before 1.4.9 Key Substitution via Identity Load
- State
- Published
- Severity
- 9.3 Critical
- Published
- Aug 27, 2026
- Updated
- Oct 1, 2026
- Reserved
- Aug 27, 2026
Description
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-345 Insufficient Verification of Data Authenticity
Affected Products
| Product | Versions |
|---|---|
openssl_encryptjahlives |
|
References
- GitHub Security Advisory (GHSA-q8p3-7h6h-ghfr)vendor-advisory
- VulnCheck Advisory: openssl_encrypt before 1.4.9 Key Substitution via Identity Loadthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.