openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including client_id, passwords, and JWTs to achieve full keyserver account takeover.
HIGH
Vulnerability intelligence
CVE-2026-81691
CVSS 4.08.7
SeverityHigh
Known exploitedNo
NVD references:
Primary source: NIST National Vulnerability Database