openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.

CVE-2026-81702 affects openssl_encrypt versions before 1.4.9, where the software fails to re-derive and validate fingerprints when loading identities from identity.json. This flaw allows attackers to substitute legitimate public keys with their own in identity stores while maintaining the claimed fingerprint. The result is silent key substitution, where encryption silently uses attacker-controlled keys and signature verification falsely appears valid. This represents a critical cryptographic integrity failure that could compromise confidentiality and authentication. Exploitation requires the ability to modify identity.json or the identity store. The vulnerability has been documented by NVD, GitHub Security Advisories, and VulnCheck. A fix is available in openssl_encrypt version 1.4.9 and later. Organizations using affected versions should upgrade immediately to prevent unauthorized key substitution attacks.