CVE-2026-81688: Missing Encryption of Sensitive Data in jahlives openssl_encrypt

The vulnerability in jahlives openssl_encrypt prior to version 1.4.9 involves the storage of an unkeyed SHA-256 hash of the plaintext in the file header metadata in cleartext. Because this hash is not protected by encryption or keyed hashing, attackers can access it without authentication. This exposure allows attackers to verify guesses of the plaintext offline and to identify identical plaintexts across separately encrypted files, potentially compromising confidentiality.

Attackers can confirm guessed plaintexts offline without needing the encryption password, reducing the effort required to decrypt or identify sensitive data. Additionally, identical plaintexts can be fingerprinted across different encrypted files, which may reveal information about the data patterns or contents. This weakens the confidentiality guarantees of the encryption scheme.

Upgrade to jahlives openssl_encrypt version 1.4.9 or later, where this issue is fixed. Patch status is confirmed by the versioning information indicating that versions before 1.4.9 are affected. No vendor advisory content was provided, so check the vendor's official sources for the latest remediation guidance.