A critical cryptographic flaw in jahlives openssl_encrypt allows unauthenticated attackers to perform unauthorized encryption and leak sensitive secrets.

This vulnerability, identified as CWE-347, stems from the improper verification of cryptographic signatures within the PublicKeyBundle.from_dict function. Unauthenticated attackers can supply untrusted data that is accepted without signature verification, enabling them to control the public keys used for encryption.

The ability to manipulate cryptographic operations allows attackers to intercept or exfiltrate sensitive data by forcing the application to use attacker-controlled keys. Given the CVSS score of 9.8, this vulnerability poses a severe threat to data confidentiality, as it effectively breaks the trust model of the encryption implementation.

Immediate Action: Update jahlives openssl_encrypt to version 1.4.0 or later to ensure all key bundles are correctly validated before use.

Proactive Monitoring: Monitor for anomalous encryption patterns or unauthorized attempts to generate key bundles within the application.

Compensating Controls: Implement strict input validation on all data passed to cryptographic modules and ensure that only known, trusted keys are permitted for sensitive operations.

Public Exploit Available: Unknown

This vulnerability represents a fundamental failure in cryptographic security that necessitates an immediate update. All systems utilizing the affected versions of openssl_encrypt should be patched to version 1.4.0 immediately to prevent potential secret leakage and unauthorized data interception.