Skip to main content

openssl_encrypt EUVDEUVD-2026-67044

| CVE-2026-81688 HIGH
Missing Encryption of Sensitive Data (CWE-311)
2026-08-27 VulnCheck GHSA-pr7j-w8v9-qr7r
Information Disclosure Openssl Encrypt
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Encrypted files are network-distributed requiring no credentials to obtain; only confidentiality is impacted via the plaintext hash oracle.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 27, 2026 - 18:02 EUVD
Analysis Generated
Aug 27, 2026 - 17:42 vuln.today
CVE Published
Aug 27, 2026 - 14:50 cve.org
HIGH 8.7

DescriptionCVE.org

openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to confirm guessed plaintexts offline or fingerprint identical plaintexts across separately-encrypted files.

AnalysisAI

openssl_encrypt by jahlives (versions before 1.4.9) embeds an unkeyed SHA-256 digest of each plaintext document into the encrypted file's cleartext header, creating a passive plaintext-confirmation oracle. Any party who possesses an encrypted file - including unauthorized recipients of intercepted or leaked archives - can extract this hash without the encryption password and use it to verify guessed or known plaintexts via offline dictionary attacks. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain encrypted file via network intercept or storage leak
Delivery
Open file in any hex or text tool
Exploit
Extract unkeyed SHA-256 hash from cleartext header
Execution
Hash candidate plaintexts offline
Impact
Compare digests to confirm original plaintext content
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must obtain a physical or logical copy of at least one encrypted file produced by openssl_encrypt prior to version 1.4.9 - this is the sole prerequisite for extracting the cleartext header hash. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) reflects high confidentiality impact once an attacker has obtained an encrypted file, and is consistent with the passive, zero-prerequisite nature of hash extraction from the file header. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who intercepts an encrypted file in transit - or retrieves one from a misconfigured storage location - opens the file header and reads the embedded SHA-256 hash without needing the encryption password. The attacker then hashes candidate plaintexts (e.g., known document templates, short messages, or dictionary words) and compares each digest against the extracted header value, confirming the original content when a match is found. …
Remediation Upgrade to openssl_encrypt version 1.4.9 or later, which removes the unkeyed SHA-256 hash from the file header; this is confirmed as the fix in GitHub Security Advisory GHSA-7c3q-gp4v-q29q (https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-7c3q-gp4v-q29q). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: conduct a complete inventory of systems and applications using openssl_encrypt library, identify all deployed versions, and immediately restrict file access to authorized personnel only. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Openssl Encrypt

View all
CVE-2026-74872 CRITICAL
9.3 Aug 17

Arbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from i
CVE-2026-74899 CRITICAL
9.3 Aug 17

Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break ou
CVE-2026-74887 CRITICAL
9.3 Aug 17

Insecure PRNG import in the jahlives openssl_encrypt Python package (all versions before 1.4.0) places Python's non-cryp
CVE-2026-81719 CRITICAL
9.3 Aug 27

Arbitrary code execution in openssl_encrypt (the jahlives Python encryption utility) before 1.4.9 allows an attacker-sup
CVE-2026-81717 CRITICAL
9.3 Aug 27

Cryptographic integrity bypass and weak key derivation in the openssl-encrypt Python package (jahlives) before 1.4.9 let
CVE-2026-81714 CRITICAL
9.3 Aug 27

Signature-trust bypass in the openssl_encrypt Python library (PyPI 'openssl-encrypt') versions 1.4.8 and earlier lets an
CVE-2026-81707 CRITICAL
9.3 Aug 27

Fingerprint-verification spoofing in jahlives openssl_encrypt before 1.4.9 lets attackers embed ANSI escape sequences in
CVE-2026-81706 CRITICAL
9.3 Aug 27

Silent cryptographic key substitution in jahlives openssl_encrypt before 1.4.9 lets attackers register 'shadow' contact

CVE-2026-81702 CRITICAL
9.3 Aug 27

Silent cryptographic key substitution affects openssl_encrypt (the jahlives Python encryption library) before 1.4.9, whi
CVE-2026-81701 CRITICAL
9.3 Aug 27

Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a den
CVE-2026-81700 CRITICAL
9.3 Aug 27

Signature verification bypass in openssl_encrypt (the jahlives Python encryption library) before version 1.4.9 lets atta
CVE-2026-81698 CRITICAL
9.3 Aug 27

Arbitrary command execution in jahlives' openssl_encrypt before 1.4.9 arises when the tool's 'info' command reconstructs

Same weakness CWE-311 – Missing Encryption of Sensitive Data

View all
CVE-2026-34486 HIGH POC
7.5
CVE-2017-8221 HIGH POC
7.5
CVE-2019-11367 CRITICAL POC
9.8
CVE-2025-69969 CRITICAL POC
9.6
CVE-2019-18800 HIGH POC
8.8
CVE-2017-6445 HIGH POC
8.1
CVE-2019-5448 HIGH POC
8.1
CVE-2018-5261 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-67044 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy