CVE-2026-81702: jahlives openssl_encrypt

CVSS 9.8 (critical) · published 2026-08-27

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.

Affected products (NVD): jahlives openssl_encrypt

Fixed in (NVD): 1.4.9

Weakness: CWE-345

Source: NVD CVE-2026-81702

References

• https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-q8p3-7h6h-ghfr
• https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-key-substitution-via-identity-load

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.