CVE-2026-81702
CriticalCVSS 9.8Summary
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate keys with their own while maintaining the claimed fingerprint, enabling silent key substitution.
Risk Assessment
An attacker can substitute public keys undetected, leading to interception of encrypted communication and false signature verification.
Recommendation
Update openssl_encrypt to version 1.4.9 or later, which includes the fix for re-deriving and validating fingerprints.
Original NVD description (English source)
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.