A critical input-validation flaw in the openssl_encrypt Python package lets attackers forge the fingerprint verification line shown to users, defeating the out-of-band check that guards against key substitution.
What Is It
openssl_encrypt before version 1.4.9 fails to sanitize the email field of imported identity documents. An attacker can embed ANSI escape sequences in that field, and when the identity is imported and rendered, those sequences manipulate terminal output; overwriting or fabricating the fingerprint verification line displayed to the user.
The result is a fraudulent fingerprint shown in place of the real one. Since fingerprint comparison is the mechanism users rely on to detect key substitution, a forged fingerprint line means a substituted key can be accepted as genuine.
NVD tracks the issue as CWE-20 (Improper Input Validation), with a CVSS v3.1 base score of 9.8 (CRITICAL): vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVSS v4.0 score assigned is 9.3 (CRITICAL).
Why It Matters
The published CVSS v3.1 vector rates the flaw as network-reachable with no privileges required (PR:N) and no user interaction required (UI:N). Note that the attack path described in the advisory does involve a user action, the victim must import the attacker-supplied identity document and view the rendered output, so the UI:N rating reflects the scoring assigned in the NVD record rather than an independently confirmed interaction-free exploitation path. Either way, the required action appears to be routine: crafted identity bundles would likely be deliverable through ordinary channels such as normal contact-exchange flows or keyserver responses, though the available source material does not document specific delivery paths, so the practical ease of reaching a target is not established.
Because the vulnerability attacks the verification display rather than the cryptography, a user following correct out-of-band verification procedure can still be deceived. Confidentiality, integrity, and availability impacts are all rated HIGH.
CVE-2026-81707 does not appear in the CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog), and there is no confirmed active exploitation or CISA-mandated remediation deadline for this CVE in the available source material.
What's Vulnerable
- Vendor: jahlives
- Product:
openssl_encrypt(PyPI:pkg:pypi/openssl-encrypt) - Affected versions: all versions before 1.4.9
- Unaffected: 1.4.9 and later
No CPE entries were published in the NVD record.
Patch Status
Fixed in openssl_encrypt 1.4.9. Upgrade to 1.4.9 or later. Identity documents imported while running an affected version should be treated as unverified; any fingerprint confirmation performed on a vulnerable build cannot be trusted and should be repeated after upgrading.
Sources
- NVD, CVE-2026-81707: https://nvd.nist.gov/vuln/detail/CVE-2026-81707
- GitHub Security Advisory GHSA-qjr2-x6mr-8xgf: https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-qjr2-x6mr-8xgf
- VulnCheck Advisory: https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-ansi-escape-injection-via-identity-email
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog