The vulnerability arises because openssl_encrypt does not sanitize the email field of imported identity documents, allowing an attacker to embed ANSI escape sequences. When the identity bundle is processed, these sequences alter the terminal output to forge the fingerprint verification line shown to the user. This manipulation causes the user to trust an attacker‑supplied key as valid, subverting the out‑of‑band verification intended to protect against key substitution attacks. The weakness is an input validation failure (CWE‑20) that enables spoofed authentication display.

The affected software is the openssl_encrypt library maintained by jahlives, any version prior to 1.4.9. The library is used in contact‑exchange flows and keyserver responses that import identity documents, so any deployment that relies on this component is susceptible. No other specific vendor or product information is listed.

The CVSS score of 9.3 classifies this as critical. EPSS information is not available, but the lack of a KEV listing does not diminish the severity. An attacker must successfully deliver a crafted identity bundle through normal contact‑exchange or keyserver interactions, which typically involves a compromised or malicious peer. Once executed, the attacker can deceive users into accepting a forged fingerprint, enabling credential substitution. The likely vector is the standard contact‑exchange or keyserver flow, with prerequisites including the user processing the malicious identity document.