CVE-2026-81702: Insufficient Verification of Data Authenticity in jahlives openssl_encrypt

The vulnerability in jahlives openssl_encrypt prior to version 1.4.9 arises from a failure to re-derive and validate fingerprints when loading identities from identity.json. This allows attackers to replace legitimate public keys in identity stores with their own keys without detection, as the fingerprint remains unchanged. Consequently, encrypted communications can be intercepted or manipulated using attacker keys, while signature verification processes continue to validate the substituted keys as legitimate.

Attackers can perform silent key substitution by replacing legitimate public keys with their own in identity stores. This compromises the confidentiality and integrity of encrypted communications, as encryption operations may use attacker keys and signature verification will not detect the substitution. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, low attack complexity, and no privileges or user interaction required.

A fix is available in jahlives openssl_encrypt version 1.4.9 and later. Users should upgrade to version 1.4.9 or newer to ensure fingerprints are properly re-derived and validated when loading identities, preventing key substitution attacks. Patch status is confirmed by the affectedVersions field indicating versions before 1.4.9 are vulnerable.