CVE-2026-81702: openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can ...

Summary

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silen...

What to do

Update jahlives openssl_encrypt to version 1.4.9 or later.

Affected software

Vendor	Product	Affected versions
jahlives	openssl_encrypt	< 1.4.9

Original advisory text

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can ...

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.

References

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-q8p3-7h6h-g... Vendor Advisory
https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-key-substituti... Third Party Advisory