CVE-2026-81697

Name of the Vulnerable Software and Affected Versions openssl-encrypt versions prior to 1.4.9

Description A configuration file resolution flaw exists in crypt settings.py where the CONFIG FILE variable is reassigned to a relative path. This causes the legacy Tk GUI's SettingsTab to read and write Key Derivation Function (KDF) settings from a crypt settings.json file located in the current working directory instead of the user's home directory. An attacker can place a malicious crypt settings.json file to silently downgrade encryption to a single hash round, bypassing weak-KDF preflight checks and facilitating offline brute-force attacks against the ciphertext.

Recommendations Update to version 1.4.9.