A critical authentication bypass vulnerability in jahlives openssl_encrypt allows unauthenticated remote attackers to fully compromise user credential management.

The library fails to perform proper validation on Bearer tokens within the verify_api_token function. This allows an unauthenticated attacker to supply arbitrary, non-empty token strings to bypass authentication, enabling unauthorized modification or revocation of user public keys.

This vulnerability poses a severe risk to identity and access management systems relying on this library. Successful exploitation could lead to unauthorized account takeover, loss of data integrity, and complete loss of control over cryptographic identities. Given the CVSS score of 9.8, this flaw represents a critical failure in security controls that requires immediate remediation.

Immediate Action: Update jahlives openssl_encrypt to version 1.4.0 or later immediately.

Proactive Monitoring: Monitor API logs for unusual patterns in Authorization headers, specifically requests containing non-standard or malformed Bearer tokens.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and validate the structure of Authorization headers, blocking requests that do not adhere to expected token formats.

Public Exploit Available: No

The severity of this vulnerability, combined with its ease of exploitation, necessitates an immediate update to the latest patched version. Security teams should prioritize patching this library across all environments to prevent potential unauthorized access and credential manipulation.