What’s Vulnerable › Vulnerabilities

CVE-2026-81702: openssl_encrypt before 1.4.9 Key Substitution via Identity Load

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-27 · updated 2026-09-03
• Weakness: CWE-345

Description

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.

Affected products

• jahlives openssl_encrypt: before 1.4.9 — fixed in 1.4.9

How to fix

Upgrade to a fixed version: jahlives openssl_encrypt 1.4.9. Check the vendor advisory for mitigations.

References

• https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-q8p3-7h6h-ghfr
• https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-key-substitution-via-identity-load

Get alerted when CVE-2026-81702 or the next vulnerability affects your stack