EUVD-2026-60113
GHSA-gvq9-cmxr-844m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, no auth, and no interaction (AV:N/AC:L/PR:N/UI:N) since any token passes; key disclosure and tampering give C:H/I:H, but no direct system availability loss so A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header.
AnalysisAI
Authentication bypass in the jahlives openssl_encrypt library (all versions before 1.4.0) lets remote unauthenticated attackers fully control the key-management API because verify_api_token treats any non-empty Bearer string as valid. An attacker can upload attacker-controlled public keys, enumerate every stored key, and revoke keys belonging to arbitrary users, undermining the confidentiality and integrity guarantees the tool is meant to provide. The flaw is vendor-confirmed with a patch available and was reported by VulnCheck; no public exploit identified at time of analysis, though the trivial nature makes weaponization simple.
Technical ContextAI
openssl_encrypt is a Python encryption/key-management utility (CPE cpe:2.3:a:jahlives:openssl_encrypt) that exposes an HTTP API guarded by Bearer-token authentication in the Authorization header. The root cause is CWE-287 (Improper Authentication): the verify_api_token function performs only a non-empty check on the supplied token rather than comparing it against a provisioned, secret credential. As a result the token acts as no barrier at all - any syntactically present Bearer value satisfies the check, collapsing the entire authentication layer that gates public-key upload, enumeration, and revocation operations.
RemediationAI
Vendor-released patch: upgrade openssl_encrypt to version 1.4.0 or later, which corrects the verify_api_token logic; this is the primary and complete fix and should be applied first (see the vendor advisory at https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-4g2c-wpgj-49w8). If an immediate upgrade is not possible, restrict network reachability of the key-management API by binding it to localhost or placing it behind a reverse proxy or firewall that enforces its own authentication, and limit source IPs to trusted management hosts - the trade-off is reduced accessibility for legitimate remote clients. As a further interim control, rotate and re-provision any public keys that may have been uploaded or revoked during the exposure window, since the bypass allows tampering that upgrading alone will not undo.
More in Openssl Encrypt
View allArbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from i
Fingerprint-verification spoofing in jahlives openssl_encrypt before 1.4.9 lets attackers embed ANSI escape sequences in
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run wit
Arbitrary code execution in jahlives openssl_encrypt before 1.4.0 stems from an inconsistent sandbox: the runtime Plugin
Authentication brute-force protection can be bypassed in jahlives openssl_encrypt before 1.4.0 because the TOTP rate lim
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break ou
Cryptographic shared-secret disclosure in the openssl_encrypt Python library (maintainer 'jahlives') before 1.4.0 lets a
Sandbox escape leading to remote code execution affects openssl_encrypt (the jahlives Python package) in all versions be
Arbitrary code execution in openssl_encrypt (the jahlives Python encryption utility) before 1.4.9 allows an attacker-sup
Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a den
Sensitive-token exposure in openssl_encrypt (the jahlives Python package, pip 'openssl-encrypt') before 1.4.0 stems from
Arbitrary command execution in jahlives' openssl_encrypt before 1.4.9 arises when the tool's 'info' command reconstructs
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today