---
id: CVE-2026-81702
aliases:
  - PYSEC-2026-3962
  - GHSA-q8p3-7h6h-ghfr
title: >-
  openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when
  loading identities from identity.json, allowing attackers …
summary: >-
  openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when
  loading identities from identity.json, allowing attackers to substitute public
  keys in identity stores. Attackers can replace legitimate public keys with
  thei…
severity: none
vendor: openssl-encrypt
product: openssl-encrypt
ecosystem: pip
affected:
  - openssl-encrypt < 1.4.9
patched:
  - openssl-encrypt 1.4.9
published: '2026-08-27'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T13:00:03.324041945Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/PYSEC-2026-3962'
references:
  - url: >-
      https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-q8p3-7h6h-ghfr
  - url: >-
      https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-key-substitution-via-identity-load
tags:
  - osv
  - pip
epss: 0.00187
epssPercentile: 0.07307
ingestedAt: '2026-09-12T03:13:01.743Z'
---

## Overview

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.

## Affected packages

- `openssl-encrypt < 1.4.9`

## Remediation

Upgrade to a patched release:

- `openssl-encrypt 1.4.9`