CVE-2026-81702CWE-345

CVE-2026-81702

Critical · published August 27, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
7.8
In the wild
Unconfirmed
What it is

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00187 · 7.8th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2026-08-27T21:21Z
Affected products (1)
ProductVersionsFixed in
jahlives/openssl_encrypt< 1.4.91.4.9
References (2)
https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-q8p3-7h6h-ghfr · [email protected]https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-key-substitution-via-identity-load · [email protected]
EPSS history
Timeline
  • 27 AUG 14:51Z
    openssl_encrypt before 1.4.9 Key Substitution via Identity Load
    cvelistv5