MEDIUMVulnerability
CVE-2026-81680
openssl_encrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery slots without re-encrypting the payload. Attackers can modify the file header to delete recovery-slot fields and bypass authentication, silently removing recovery paths the owner deliberately added.
Properties
- severity
- MEDIUM
- score
- 4
- epss_score
- 0.00145
- cve_id
- CVE-2026-81680
- vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- published_at
- 2026-08-27T17:20:57.300
- last_modified
- 2026-09-03T15:06:30.603
- epss_percentile
- 0.04079
Related Entities (4)
ENRICHED_BY (1)
→[Source]FIRST EPSS
HAS_WEAKNESS (1)
→[Weakness]Improper Verification of Cryptographic Signature
DESCRIBED_BY (1)
→[Source]NVD
AFFECTS_PRODUCT (1)
→[Product]
Explore deeper with Ninja Signal's threat intelligence graph