CVE-2026-81702

Analyzed Analyzed - Analysis Complete

OpenSSL Identity Key Substitution in identity.json

Publication date: 2026-08-27

Last updated on: 2026-09-03

Assigner: VulnCheck

Description

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-03

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-81702

EUVD

EUVD-2026-67058

Affected Vendors & Products

Vendor	Product	Version / Range
jahlives	openssl_encrypt	to 1.4.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

This vulnerability affects openssl_encrypt versions before 1.4.9. It allows attackers to replace legitimate public keys in identity stores with their own while keeping the claimed fingerprint intact. This means encryption uses attacker-controlled keys, but signature verification still appears valid because the fingerprint matches.

Detection Guidance

Check openssl_encrypt version with 'openssl_encrypt --version' or inspect identity.json files for mismatched fingerprints. Compare stored fingerprints in identity.json against actual .pem public keys to detect inconsistencies.

Impact Analysis

Attackers could intercept encrypted communications or forge signed data by substituting keys. Systems relying on openssl_encrypt for encryption or authentication could be tricked into using malicious keys, leading to data breaches or unauthorized access.

Compliance Impact

This vulnerability could violate compliance requirements for data integrity and confidentiality. GDPR requires protecting personal data, and HIPAA mandates secure transmission of health information. A key substitution attack undermines these protections, potentially leading to non-compliance and legal consequences.

Mitigation Strategies

Upgrade openssl_encrypt to version 1.4.9 or later. Verify all identity.json files by recomputing fingerprints from .pem files and remove any mismatched entries. Re-import identities to ensure consistency.

Hi! I’m here to help you understand CVE-2026-81702. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70