CVE-2026-81688 openssl_encrypt before 1.4.9 Plaintext Confirmation Oracle via SHA-256

High 8.7 Published 27 Aug 2026 Updated 1 Oct 2026

Attackers can confirm guessed plaintexts or fingerprint identical files by reading unkeyed SHA-256 hashes stored in cleartext headers.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-81688?

CVE-2026-81688 is a high-severity vulnerability in Jahlives Openssl Encrypt, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to confirm guessed plaintexts offline or fingerprint identical plaintexts across separately-encrypted files.

Weakness: CWE-311

Which versions are affected by CVE-2026-81688?

1 open source package ship an affected version, including openssl-encrypt. It affects 1 product.

Package	Affected	Fixed in
`openssl-encrypt` PyPI	All versions	`1.4.9`

Products include Jahlives Openssl Encrypt.

How do I fix CVE-2026-81688?

Upgrade openssl-encrypt to 1.4.9 or later.

Is CVE-2026-81688 being exploited?

There is no known exploitation of CVE-2026-81688 in the wild and no public exploit code.

All Jahlives Openssl Encrypt vulnerabilities

Sources

Also known as GHSA-7c3q-gp4v-q29q, GHSA-pr7j-w8v9-qr7r, PYSEC-2026-3795.