CVE-2026-81702 - openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid. - 漏洞详情

漏洞编号：CVE-2026-81702

风险等级：危急

漏洞来源：CVE

CVE 编号：CVE-2026-81702

CNNVD 编号：-

厂商/产品：- / -

影响范围：-

CWE：CWE-345

发布/更新时间：2026-08-27 / 2026-08-27

漏洞描述

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.

漏洞描述

相关链接

相关漏洞