CVE-2026-81707: Improper Input Validation in jahlives openssl_encrypt

The vulnerability in jahlives' openssl_encrypt (versions before 1.4.9) arises from failure to sanitize the email field of imported identity documents. Attackers can exploit this by injecting ANSI escape sequences that manipulate terminal output to display a fraudulent fingerprint verification line. This attack vector can be triggered through normal contact-exchange flows or responses from keyservers, effectively bypassing the fingerprint verification step designed to protect against key substitution attacks.

Successful exploitation allows attackers to forge the fingerprint verification line displayed to users, undermining the out-of-band verification mechanism. This can lead to undetected key substitution attacks, potentially compromising the authenticity of encrypted communications. The CVSS 4.0 score of 9.3 reflects the critical nature of this vulnerability with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

A fix is available in jahlives openssl_encrypt version 1.4.9 and later. Users should upgrade to version 1.4.9 or newer to remediate this vulnerability. No vendor advisory content was provided, so patch status is based on the version information given. Until patched, avoid importing identity documents from untrusted sources and be cautious with contact-exchange flows and keyserver responses.