Vulnerability Description
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jahlives | Openssl Encrypt | < 1.4.9 |
Related Weaknesses (CWE)
References
- https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-q8p3-7h6h-gVendor Advisory
- https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-key-substitutiThird Party Advisory
FAQ
What is CVE-2026-81702?
CVE-2026-81702 is a vulnerability with a CVSS score of 9.8 (CRITICAL). openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can rep...
How severe is CVE-2026-81702?
CVE-2026-81702 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-81702?
Check the references section above for vendor advisories and patch information. Affected products include: Jahlives Openssl Encrypt.