{"id":"CVE-2026-81702","title":"openssl_encrypt before 1.4.9 Key Substitution via Identity Load","summary":"openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with thei…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-345"],"vendor":"jahlives","product":"openssl_encrypt","affected":["openssl_encrypt < 1.4.9"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-08-31T15:58:58.550416Z"},"published":"2026-08-27","updated":"2026-10-01","sourceUpdated":"2026-10-01T15:21:31.062Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-81702","references":[{"url":"https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-q8p3-7h6h-ghfr","label":"GitHub Security Advisory (GHSA-q8p3-7h6h-ghfr)"},{"url":"https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-key-substitution-via-identity-load","label":"VulnCheck Advisory: openssl_encrypt before 1.4.9 Key Substitution via Identity Load"}],"tags":["cve.org","osv","pip"],"epss":0.00187,"epssPercentile":0.08186,"aliases":["PYSEC-2026-3962","GHSA-q8p3-7h6h-ghfr"],"ecosystem":"pip","patched":["openssl-encrypt 1.4.9"],"ingestedAt":"2026-09-12T03:13:01.743Z","slug":"CVE-2026-81702","body":"## Overview\n\nopenssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.\n\n## Affected\n\n- `openssl_encrypt < 1.4.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-81702)\n\nAffected packages:\n\n- `openssl-encrypt < 1.4.9`\n\nPatched in:\n\n- `openssl-encrypt 1.4.9`\n\nSource: https://osv.dev/vulnerability/PYSEC-2026-3962","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":214398,"id":"CVE-2026-81702","ts":1790869813330,"field":"cvss","old":null,"new":"9.8"},{"seq":214397,"id":"CVE-2026-81702","ts":1790869813330,"field":"severity","old":"none","new":"critical"}]}