CVE-2026-81704: Use of Password Hash With Insufficient Computational Effort in jahlives openssl_encrypt

The vulnerability CVE-2026-81704 affects jahlives' openssl_encrypt versions prior to 1.4.9. The D-Bus CryptoService.EncryptFile handler uses a weak key derivation method by relying on unstretched SHA-256 rather than Argon2id, a modern key stretching algorithm. This results in significantly reduced computational effort required for offline password guessing attacks, enabling attackers to guess passwords roughly six to seven orders of magnitude faster than the documented protection level. The CVSS 4.0 score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality.

Attackers can perform offline password guessing attacks against encrypted files protected by the vulnerable versions of openssl_encrypt. Due to the weak key derivation function, the computational effort required is drastically reduced, enabling attackers to guess passwords millions of times faster than intended. This compromises the confidentiality of encrypted data without requiring network access or privileges.

A fix is available in jahlives openssl_encrypt version 1.4.9 and later, which replaces the weak unstretched SHA-256 key derivation with Argon2id. Users should upgrade to version 1.4.9 or later to mitigate this vulnerability. No vendor advisory was provided to contradict this; therefore, upgrading is the recommended remediation.