CVE-2026-81691 openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs

High 8.7 Published 27 Aug 2026 Updated 1 Oct 2026

Attackers can intercept cleartext credentials and JWTs due to unvalidated server URLs, leading to full keyserver account takeover.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-81691?

CVE-2026-81691 is a high-severity vulnerability in Jahlives Openssl Encrypt, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including client_id, passwords, and JWTs to achieve full keyserver account takeover.

Weakness: CWE-319

Which versions are affected by CVE-2026-81691?

1 open source package ship an affected version, including openssl-encrypt. It affects 1 product.

Package	Affected	Fixed in
`openssl-encrypt` PyPI	All versions	`1.4.9`

Products include Jahlives Openssl Encrypt.

How do I fix CVE-2026-81691?

Upgrade openssl-encrypt to 1.4.9 or later.

Is CVE-2026-81691 being exploited?

There is no known exploitation of CVE-2026-81691 in the wild and no public exploit code.

All Jahlives Openssl Encrypt vulnerabilities

Sources

Also known as GHSA-cw5r-mrc2-mrh5, GHSA-xr64-hcxg-4ghr, PYSEC-2026-3797.