A high-severity authorization bypass vulnerability in the jahlives openssl_encrypt package allows authenticated attackers to perform unauthorized operations by manipulating user-controlled keys.

This vulnerability, identified as CWE-639, involves an authorization bypass through user-controlled keys. The flaw requires the attacker to have low-level privileges to successfully interact with the vulnerable function.

Successful exploitation of this vulnerability could lead to significant data compromise and unauthorized modification of encrypted information, given the high CVSS score of 8.8. This flaw poses a direct threat to the integrity and confidentiality of sensitive data managed by the software, potentially resulting in severe operational disruption and loss of trust.

Immediate Action: Upgrade the openssl_encrypt package to version 1.4.0 or later to apply the necessary security fixes.

Proactive Monitoring: Monitor application logs for suspicious access patterns or unexpected attempts to modify encryption keys or sensitive configuration parameters.

Compensating Controls: Implement strict identity and access management controls to minimize the number of users with the low-level privileges required to trigger this vulnerability.

Public Exploit Available: Unknown

The severity of this authorization bypass necessitates immediate attention. Organizations utilizing the jahlives openssl_encrypt library should prioritize updating to version 1.4.0 to neutralize the risk of unauthorized access and data manipulation.