---
id: CVE-2026-81702
title: openssl_encrypt before 1.4.9 Key Substitution via Identity Load
summary: >-
  openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when
  loading identities from identity.json, allowing attackers to substitute public
  keys in identity stores. Attackers can replace legitimate public keys with
  thei…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-345
vendor: jahlives
product: openssl_encrypt
affected:
  - openssl_encrypt < 1.4.9
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-08-31T15:58:58.550416Z'
published: '2026-08-27'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T15:21:31.062Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-81702'
references:
  - url: >-
      https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-q8p3-7h6h-ghfr
    label: GitHub Security Advisory (GHSA-q8p3-7h6h-ghfr)
  - url: >-
      https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-key-substitution-via-identity-load
    label: >-
      VulnCheck Advisory: openssl_encrypt before 1.4.9 Key Substitution via
      Identity Load
tags:
  - cve.org
  - osv
  - pip
epss: 0.00187
epssPercentile: 0.08186
aliases:
  - PYSEC-2026-3962
  - GHSA-q8p3-7h6h-ghfr
ecosystem: pip
patched:
  - openssl-encrypt 1.4.9
ingestedAt: '2026-09-12T03:13:01.743Z'
---

## Overview

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.

## Affected

- `openssl_encrypt < 1.4.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-81702)

Affected packages:

- `openssl-encrypt < 1.4.9`

Patched in:

- `openssl-encrypt 1.4.9`

Source: https://osv.dev/vulnerability/PYSEC-2026-3962