CVE-2026-81689— openssl_encrypt before 1.4.9 Weak Pepper Key Derivation
Quick assessment
Affected
jahlives openssl_encrypt
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 openssl_encrypt 版本低于 1.4.9 中，远程盐值（remote-pepper）封装密钥的推导方式是使用无盐的 HKDF-SHA256 或对密码直接使用裸 SHA-256 哈希。这导致所有用户和文件使用完全相同的密钥。能够访问封装盐值数据块的攻击者，可以预先计算一张字典表，并以硬件速度对全部用户执行离线密码猜测，从而恢复用户密码。
Possible ATT&CK Techniques 1 AI
T1557.001 · Name Resolution Poisoning and SMB RelayAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| jahlives | openssl_encrypt | < 1.4.9 |
affected |
1.4.9 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81689
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
openssl_encrypt before 1.4.9 Weak Pepper Key Derivation
Source: CVE Program / CVE List V5
Vulnerability Description
openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all users and files. Attackers with access to wrapped pepper blobs can precompute a single dictionary table and perform fleet-wide offline password guessing at hardware speed to recover user passwords.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用具有不充分计算复杂性的口令哈希
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| jahlives | openssl_encrypt | 0 ~ 1.4.9 | - |
|
II. Public POCs for CVE-2026-81689
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81689
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-81689 (2)
-
-
🔗 openssl_encrypt before 1.4.9 Weak Pepper Key Derivation | Advisories | VulnCheck third-party-advisory
Same Patch Batch · jahlives · 2026-08-27 · 36 CVEs total
| CVE-2026-81707 | 9.8 CRITICAL | openssl_encrypt before 1.4.9 ANSI Escape Injection via Identity Email |
| CVE-2026-81701 | 9.8 CRITICAL | openssl_encrypt before 1.4.9 Arbitrary Code Execution via unsigned plugin |
| CVE-2026-81700 | 9.8 CRITICAL | openssl_encrypt before 1.4.9 GPG Signature Verification Bypass |
| CVE-2026-81702 | 9.8 CRITICAL | openssl_encrypt before 1.4.9 Key Substitution via Identity Load |
| CVE-2026-81683 | 8.4 HIGH | openssl_encrypt before 1.4.9 Plaintext Private Key Storage |
| CVE-2026-81719 | 7.8 HIGH | openssl_encrypt before 1.4.9 Remote Code Execution via Plugin |
| CVE-2026-81704 | 7.5 HIGH | openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus |
| CVE-2026-81691 | 7.5 HIGH | openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs |
| CVE-2026-81721 | 7.5 HIGH | openssl_encrypt before 1.4.9 Denial of Service via KDF |
| CVE-2026-81698 | 7.5 HIGH | openssl_encrypt before 1.4.9 Shell Injection via info command |
| CVE-2026-81693 | 7.5 HIGH | openssl_encrypt before 1.4.9 Denial of Service via QR total field |
| CVE-2026-81705 | 7.5 HIGH | openssl-encrypt before 1.4.9 Password Cleartext Leak via Debug |
| CVE-2026-81699 | 7.5 HIGH | openssl_encrypt before 1.4.9 Denial of Service via unbounded KDF cost |
| CVE-2026-81692 | 7.5 HIGH | openssl_encrypt before 1.4.9 Denial of Service via STREAMINFO |
| CVE-2026-81688 | 7.5 HIGH | openssl_encrypt before 1.4.9 Plaintext Confirmation Oracle via SHA-256 |
| CVE-2026-81718 | 7.5 HIGH | openssl_encrypt before 1.4.9 Weak Cryptographic Parameters |
| CVE-2026-81690 | 7.3 HIGH | verify-usb before 1.4.9 Symlink Directory Traversal Code Execution |
| CVE-2026-81714 | 7.0 HIGH | openssl_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment Bypass |
| CVE-2026-81706 | 6.8 MEDIUM | openssl_encrypt before 1.4.9 Key Substitution via Identity Shadowing |
| CVE-2026-81686 | 6.2 MEDIUM | openssl_encrypt before 1.4.9 D-Bus Properties Authorization Bypass |
Showing top 20 of 36 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: openssl_encrypt
-
CVE-2026-81721
openssl_encrypt before 1.4.9 Denial of Service via KDF -
CVE-2026-81719
openssl_encrypt before 1.4.9 Remote Code Execution via Plugi -
CVE-2026-81720
openssl_encrypt before 1.4.9 Denial of Service via Unbounded -
CVE-2026-81718
openssl_encrypt before 1.4.9 Weak Cryptographic Parameters -
CVE-2026-81717
openssl_encrypt before 1.4.9 Integrity Bypass via Added File
Same vendor: jahlives
-
CVE-2026-81721
openssl_encrypt before 1.4.9 Denial of Service via KDF -
CVE-2026-81719
openssl_encrypt before 1.4.9 Remote Code Execution via Plugi -
CVE-2026-81720
openssl_encrypt before 1.4.9 Denial of Service via Unbounded -
CVE-2026-81718
openssl_encrypt before 1.4.9 Weak Cryptographic Parameters -
CVE-2026-81717
openssl_encrypt before 1.4.9 Integrity Bypass via Added File
Same weakness: CWE-916
-
CVE-2026-81704
openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus -
CVE-2026-80211
FrontAccounting through 2.4.20 Use of Unsalted MD5 for Passw -
CVE-2026-53762
VeraCryp: wolfCrypt backend bypasses VeraCrypt PBKDF2 iterat -
CVE-2026-75112
OTTO® Fleet Manager – Weak Password Hashing Configuration -
CVE-2026-74871
openssl_encrypt before 1.4.6 KDF Bypass via Sequential-XOR
V. Comments for CVE-2026-81689
No comments yet