CVE-2026-81691
HighCVSS 7.5Summary
openssl_encrypt before 1.4.9 fails to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including client_id, passwords, and JWTs to achieve full keyserver account takeover.
Risk Assessment
The organization is exposed to credential interception and account takeover, potentially leading to data integrity compromise.
Recommendation
Upgrade openssl_encrypt to 1.4.9 or later, which enforces secure connections and validates hosts.
Original NVD description (English source)
openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including client_id, passwords, and JWTs to achieve full keyserver account takeover.