CVE-2026-81691: openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs
opensslencrypt versions before 1.4.9 fail to validate server URLs in login and registerwithemail functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including clientid, passwords, and JWTs to achieve full keyserver account takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.9 - Compensating control
Ensure server URLs passed to the login and register_with_email functions use encrypted transport (avoid accepting unencrypted http:// URLs) and only allow validated, properly configured hosts to prevent cleartext credential interception on the network path.
Event History
Frequently Asked Questions
Who is exposed to credential interception?
Deployments using openssl_encrypt versions before 1.4.9 are exposed when the login or register_with_email functions connect to an unencrypted http:// server URL or an unconfigured host. An attacker positioned on the network path can intercept the transmitted credentials.
What access does an attacker need to exploit this issue?
The attacker needs a position on the network path between the affected client and server. No privileges or user interaction are required according to the supplied severity vector.
What information can be exposed, and what is the impact?
Cleartext client_id values, passwords, and JWTs can be intercepted. The advisory states that these credentials can enable full keyserver account takeover.
What configuration should be checked while awaiting an update?
Review server URLs used by login and register_with_email and identify any http:// endpoints or unconfigured hosts. Avoid sending credentials through those endpoints until the affected component is updated to a version that addresses the issue.