Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-81702

openssl_encrypt before 1.4.9 Key Substitution via Identity Load

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

jahlives openssl_encrypt

Default version status: unaffected

  • 0 to < 1.4.9affected
  • 1.4.9unaffected
pkg:pypi/openssl-encrypt

References