CVE-2026-81706

opensslencrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes...

CVE-2026-81706 openssl_encrypt before 1.4.9 Key Substitution via Identity Shadowing

opensslencrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes...

CVE-2026-81706

openssl_encrypt before 1.4.9 is vulnerable to key substitution via identity shadowing . The root cause lies in IdentityStore , which fails to prevent namespace collisions between a user's own identities and contacts. An attacker can create shadowed contact entries that remain invisible until the ...

CVE-2026-81703

openssl_encrypt versions before 1.4.9 fail to validate the encryption status of embedded post-quantum private keys in file metadata. An attacker can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext wit...

EUVD-2026-67060

opensslencrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faste...

CVE-2026-81703 openssl_encrypt before 1.4.9 Authentication Bypass via Unencrypted PQC Key

opensslencrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false...

EUVD-2026-67059

opensslencrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false...

CVE-2026-81704 openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus

opensslencrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faste...

CVE-2026-81704

opensslencrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faste...

CVE-2026-81703

opensslencrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false...

CVE-2026-81704 openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus

opensslencrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faste...

CVE-2026-81703 openssl_encrypt before 1.4.9 Authentication Bypass via Unencrypted PQC Key

opensslencrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false...

CVE-2026-81704 openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus

opensslencrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faste...

CVE-2026-81703 openssl_encrypt before 1.4.9 Authentication Bypass via Unencrypted PQC Key

opensslencrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false...

CVE-2026-81704

openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler. The affected code uses unstretched SHA-256 instead of Argon2id , omitting key stretching and hash rounds. This allows attackers to perform offline password guessing ag...

CVE-2026-81702

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, enabling silent key substitution . An attacker can replace legitimate public keys in identity stores with their own while maintaining the claimed fingerprint, so that encryption u...

EUVD-2026-67058

opensslencrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling...

CVE-2026-81702 openssl_encrypt before 1.4.9 Key Substitution via Identity Load

opensslencrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling...

CVE-2026-81702

opensslencrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling...

CVE-2026-81702 openssl_encrypt before 1.4.9 Key Substitution via Identity Load

opensslencrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling...