CVE-2026-81689
Received Received - Intake

OpenSSL Encrypt Pre-Authentication Password Recovery Vulnerability

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description
openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all users and files. Attackers with access to wrapped pepper blobs can precompute a single dictionary table and perform fleet-wide offline password guessing at hardware speed to recover user passwords.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-81689
EUVD
EUVD-2026-67045

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openssl openssl_encrypt to 1.4.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-916 The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects openssl_encrypt versions before 1.4.9. It involves deriving a remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, which results in identical keys across all users and files. Attackers with access to wrapped pepper blobs can precompute a single dictionary table and perform offline password guessing at hardware speed to recover user passwords.

Detection Guidance

This vulnerability involves weak key derivation in openssl_encrypt versions before 1.4.9. Detection requires checking installed versions of openssl_encrypt and inspecting cryptographic operations using unsalted HKDF-SHA256 or bare SHA-256 for password wrapping. No specific commands are provided in the context.

Impact Analysis

If you use openssl_encrypt versions before 1.4.9, attackers could recover user passwords by exploiting this vulnerability. This could lead to unauthorized access to sensitive data, compromised accounts, or further attacks on systems relying on these passwords.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Immediately upgrade openssl_encrypt to version 1.4.9 or later to address the weak key derivation issue. Review and regenerate all wrapped pepper blobs using the updated library to prevent precomputed dictionary attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81689. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart