Description

openssl_encrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revoke_key method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership restriction.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-17T11:16:42.203Z",
  "pubdate": "2026-08-17T11:16:42.203Z",
  "executiveSummary": "A missing ownership verification vulnerability exists in openssl_encrypt versions prior to 1.4.0, specifically within the revoke_key method. This flaw enables authenticated clients to arbitrarily revoke cryptographic keys belonging to other users.\nThe vulnerability represents an authorization bypass issue stemming from a failure to validate whether the entity requesting key revocation possesses administrative ownership or rightful control over the target key material.\nImpacted systems include any deployments utilizing openssl_encrypt versions below 1.4.0 that implement the affected revoke_key functionality. The risk implications are severe, as malicious actors can cause widespread denial of service by invalidating legitimate client keys across the system.\nTo exploit this vulnerability, an attacker must possess authenticated client access and be capable of generating or providing a valid ML-DSA signature. Upon fulfilling these requirements, the attacker can successfully bypass intended security boundaries and execute unauthorized revocation operations against arbitrary keys.",
  "technicalDetails": "The root cause of the vulnerability resides in the revoke_key method of openssl_encrypt versions prior to 1.4.0. The method fails to perform adequate ownership checks or cryptographic binding validations to ensure that the entity initiating the revocation request matches the owner of the target key.\nThe vulnerable component is the key revocation subsystem, specifically handling processing logic within the revoke_key function. The affected versions comprise all iterations of openssl_encrypt prior to 1.4.0.\nAuthentication requirements dictate that the attacker must be an authenticated client within the system to interact with the interface exposed by the revoke_key method. However, no elevated privileges are required beyond standard client authentication, and the vulnerability allows standard users to exceed their intended authorization scope.\nThe exploitation method relies on the submission of a valid ML-DSA signature to the revoke_key routine. Because the function verifies the cryptographic validity of the provided signature but omits checks verifying whether the signer owns the targeted key, the verification passes successfully despite the authorization discrepancy.\nThe step-by-step attack flow proceeds as follows: First, the authenticated attacker identifies or targets the identifier of a victim client's key. Second, the attacker formulates a revocation request targeting the victim's key. Third, the attacker supplies a valid ML-DSA signature corresponding to their own authenticated session or an acceptable format accepted by the signature validation logic. Fourth, the revoke_key method processes the input, successfully validates the ML-DSA signature, and commits the revocation of the arbitrary target key without enforcing ownership constraints.\nThe post-exploitation impact includes immediate cryptographic denial of service for affected clients whose keys are unjustly revoked, potentially disrupting secure communications, authentication mechanisms, and downstream transactional processes reliant on the compromised keys."
}