EUVD-2026-60101
GHSA-24vg-mjm2-36jv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:A because exploitation is explicitly constrained to RFC 1918 private network adjacency, directly contradicting the provided AV:N; PR:N because no prior authentication is required to send the forged header.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation is relaxed or modified.
AnalysisAI
openssl_encrypt (jahlives, versions before 1.4.0) ships with an insecure default trusted_proxies configuration that grants implicit trust to all RFC 1918 private address space in IntegrityProxyConfig, enabling mutual TLS authentication bypass via forged client certificate headers. Any attacker with access to a co-located private network segment can inject a crafted header that the library accepts as a legitimate certificate identity, effectively impersonating an authenticated mTLS principal. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the authentication bypass class is operationally severe for any deployment relying on mTLS for access control.
Technical ContextAI
openssl_encrypt (CPE: cpe:2.3:a:jahlives:openssl_encrypt:*:*:*:*:*:*:*:*) is a PHP library authored by jahlives that provides encryption utilities and proxy-aware authentication handling. The vulnerability class is CWE-345 (Insufficient Verification of Data Authenticity): the library's IntegrityProxyConfig does not verify that HTTP headers presenting client certificate information were injected by a genuinely trusted proxy - instead, it defaults to trusting any source within RFC 1918 address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). When ProxyAuth validation is relaxed or modified, this trust decision is never challenged, so a forged header originating from any private-network host passes without cryptographic verification. The root failure is that RFC 1918 membership is not a trustworthy proxy-identity signal in shared or multi-tenant network environments.
RemediationAI
Upgrade openssl_encrypt to version 1.4.0 or later, which corrects the insecure default configuration in IntegrityProxyConfig. Consult the vendor advisory at https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-2592-7m3g-7fq6 for upgrade guidance. As a compensating control pending upgrade, operators should explicitly enumerate only known legitimate proxy IP addresses in the trusted_proxies configuration, replacing the default RFC 1918 wildcard trust; note this requires accurate knowledge of network topology and must be updated whenever proxy infrastructure changes. Additionally, review the ProxyAuth validation configuration to ensure it has not been relaxed or modified from a secure baseline, as the description identifies relaxed ProxyAuth as a compounding condition. Blocking RFC 1918 source addresses at perimeter controls is not a viable standalone mitigation if the application is hosted within a private network.
More in Openssl Encrypt
View allArbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from i
Fingerprint-verification spoofing in jahlives openssl_encrypt before 1.4.9 lets attackers embed ANSI escape sequences in
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run wit
Arbitrary code execution in jahlives openssl_encrypt before 1.4.0 stems from an inconsistent sandbox: the runtime Plugin
Authentication bypass in the jahlives openssl_encrypt library (all versions before 1.4.0) lets remote unauthenticated at
Authentication brute-force protection can be bypassed in jahlives openssl_encrypt before 1.4.0 because the TOTP rate lim
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break ou
Cryptographic shared-secret disclosure in the openssl_encrypt Python library (maintainer 'jahlives') before 1.4.0 lets a
Sandbox escape leading to remote code execution affects openssl_encrypt (the jahlives Python package) in all versions be
Arbitrary code execution in openssl_encrypt (the jahlives Python encryption utility) before 1.4.9 allows an attacker-sup
Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a den
Sensitive-token exposure in openssl_encrypt (the jahlives Python package, pip 'openssl-encrypt') before 1.4.0 stems from
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today