VULNERABILITY INTELLIGENCE

CVE-2026-81702

CVSS score9.8 CRITICAL
EPSS probability0.19%
CISA KEVNot currently listed
Published2026-08-27
Last modified2026-09-03
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.

Weakness classification

  • disclosure@vulncheck.com: CWE-345

Primary references