CVE-2026-81706: Insufficient Verification of Data Authenticity in jahlives openssl_encrypt

The vulnerability in jahlives openssl_encrypt prior to version 1.4.9 arises from insufficient verification of data authenticity, specifically failing to prevent namespace collisions between own identities and contacts within the IdentityStore. Attackers can exploit this flaw to create shadowed contact entries that are initially invisible. When the legitimate own identity is deleted, these shadowed contacts become visible and map to the attacker's cryptographic keys, allowing silent substitution of keys used to encrypt files. This undermines the confidentiality and integrity of encrypted data.

An attacker can silently substitute encryption keys by creating shadowed contact entries that become active upon deletion of the legitimate own identity. This enables unauthorized decryption or manipulation of encrypted files without detection, severely compromising data confidentiality and integrity. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

A fixed version of jahlives openssl_encrypt is available starting from version 1.4.9. Users should upgrade to version 1.4.9 or later to remediate this vulnerability. Since no vendor advisory or patch links are provided, verify the availability of the fix from the official jahlives project resources before upgrading. Patch status is confirmed by the affectedVersions field indicating versions before 1.4.9 are vulnerable.