CVE-2026-81689 in openssl_encrypt
Summary
by MITRE • 08/27/2026
openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all users and files. Attackers with access to wrapped pepper blobs can precompute a single dictionary table and perform fleet-wide offline password guessing at hardware speed to recover user passwords.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability in openssl_encrypt versions prior to 1.4.9 represents a critical failure in cryptographic key derivation, fundamentally undermining the security of data encrypted with remote-pepper wrappers. The core technical flaw lies in the method used to generate encryption keys from user-provided passwords. Instead of employing salted hash functions or proper Key Derivation Functions that incorporate unique random salts for each instance, these versions utilize unsalted HKDF-SHA256 or bare SHA-256 hashing based solely on the password itself. This design choice results in deterministic key generation where identical inputs always produce identical outputs. Consequently, if multiple users employ the same password, they will all derive the exact same encryption key for their respective wrapped pepper blobs. This lack of uniqueness per user and per file creates a catastrophic security weakness that transforms what should be an isolated brute-force challenge into a scalable, fleet-wide attack vector.
From an operational perspective, this flaw allows attackers with access to stored encrypted data to perform highly efficient offline password guessing attacks. Because the key derivation is deterministic and unsalted, an attacker can precompute a single dictionary table mapping common passwords to their corresponding derived keys. This table can then be applied against all compromised wrapped pepper blobs simultaneously. The absence of salts means that rainbow tables or similar precomputation techniques are fully effective, enabling attackers to recover user passwords at hardware speed using modern GPUs or specialized ASICs. This significantly reduces the time and computational cost required to compromise multiple accounts compared to traditional salted hashing scenarios where each password requires independent computation.
This vulnerability aligns with CWE-798: Use of Hard-coded Credentials when considering the deterministic nature of key generation, but more accurately maps to CWE-320: Key Exchange Using Incorrect Algorithm or Parameter and CWE-641: Improper Restriction of Names for Files and Directories if interpreted broadly as improper resource handling. In terms of attack tactics, this falls under MITRE ATT&CK technique T1110: Brute Force, specifically the Offline Password Guessing subcategory (T1110.003). The ability to precompute keys means that once an attacker gains access to the encrypted blobs, they can bypass online rate-limiting protections entirely and conduct massive-scale credential stuffing or password recovery operations without triggering typical detection mechanisms associated with repeated login attempts.
To mitigate this vulnerability, organizations must immediately upgrade openssl_encrypt to version 1.4.9 or later where the key derivation process has been corrected to include proper salting mechanisms. It is essential that each encryption operation uses a unique, cryptographically secure random salt combined with an appropriate Key Derivation Function such as PBKDF2, scrypt, Argon2, or HKDF with distinct salts per user and file. This ensures that even if two users share the same password, their derived keys will differ, preventing precomputation attacks and forcing attackers to perform separate brute-force attempts for each target. Additionally, implementing strong password policies and multi-factor authentication can provide defense-in-depth against residual risks from weak user-chosen passwords.