opens ssl_encrypt uses a suffix-tolerant fingerprint check when enrolling a plugin‑signing trust anchor. When an operator confirms a short, easily forgeable GPG key ID, the verifier accepts any key that shares the same trailing bits, allowing an attacker’s colliding key to be enrolled as trusted. Once enrolled, that key can sign malicious plugins, which the application will accept under the ENFORCE signature policy, effectively granting the attacker code execution rights. The weakness is a form of improper fingerprint verification, classified as CWE‑347.

The vulnerability exists in the jahlives openssl_encrypt Python package versions 1.4.8 and earlier. Version 1.4.9 introduced strict matching of the full primary‑key fingerprint during enrollment, eliminating the suffix tolerance and thereby securing against this issue.

The CVSS score of 9.3 designates this a critical flaw. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation is likely to be local or semi‑local, requiring an operator who can confirm the short key ID or an automated process that performs the confirmation. The attack vector is inferred from the description: an operator or automated installer might unknowingly enroll a colliding key. Mitigation by updating to 1.4.9 removes the risk entirely.