CVE-2026-81703: openssl_encrypt before 1.4.9 Authentication Bypass via Unencrypted PQC Key
opensslencrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false integrity verification.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.9 - Compensating control
Ensure encrypted files are rejected or validated such that they cannot contain unencrypted embedded post-quantum private keys that decrypt under any password (since openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded PQC private keys).
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users or systems that process attacker-supplied files with affected openssl_encrypt versions before 1.4.9 are exposed. Exploitation depends on the application accepting and decrypting crafted files containing embedded PQC private-key metadata.
What does an attacker need to exploit the vulnerability?
An attacker needs to craft a file with an unencrypted embedded post-quantum private key. The crafted file can decrypt under any password and yield attacker-chosen plaintext while falsely appearing to pass integrity verification.
Is user interaction required?
Yes. The supplied vector indicates user interaction is required, consistent with a victim needing to open or otherwise process a crafted file.
How can I determine whether I am affected?
Check whether your deployment uses openssl_encrypt before version 1.4.9 and processes files containing embedded PQC private-key metadata. Such versions do not validate whether those embedded keys are encrypted.