CVE-2026-81706CWE-345

CVE-2026-81706

Medium · published August 27, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
7.3
In the wild
Unconfirmed
What it is

openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes visible and resolves to the attacker's keys, enabling silent key substitution for encrypted files.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00181 · 7.3th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2026-08-27T21:21Z
Affected products (1)
ProductVersionsFixed in
jahlives/openssl_encrypt< 1.4.91.4.9
References (2)
https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-8gmx-w9m8-vx7q · [email protected]https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-key-substitution-via-identity-shadowing · [email protected]
EPSS history
Timeline
  • 27 AUG 14:51Z
    openssl_encrypt before 1.4.9 Key Substitution via Identity Shadowing
    cvelistv5