EUVD-2026-60111
GHSA-qg6r-j76g-wv2q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with no authentication required; confidentiality impact high due to full telemetry API auth bypass; no integrity or availability impact confirmed by description or CVSS 4.0 vector.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication.
AnalysisAI
Authentication bypass in the jahlives/openssl_encrypt PHP library (all versions before 1.4.0) exposes deployments running the standalone telemetry server to full API authentication compromise via hardcoded credentials. The static default secret key embedded in the telemetry server configuration is used for API key hashing; any attacker who obtains this now-public value can reconstruct valid API key hashes and authenticate to the telemetry API without possessing legitimate credentials. The vendor has released a fix in version 1.4.0, confirmed via GHSA-p926-6hjp-w9jw; no public exploit code or CISA KEV listing has been identified at the time of analysis.
Technical ContextAI
The affected component is the standalone telemetry server bundled with the jahlives/openssl_encrypt PHP library (CPE: cpe:2.3:a:jahlives:openssl_encrypt:*:*:*:*:*:*:*:*, all versions before 1.4.0). The root cause is CWE-798 (Use of Hard-coded Credentials): rather than requiring operators to supply a deployment-unique secret at install time, the library ships a static developer-defined key as the default, which is used as the HMAC or hash salt for API key derivation in the telemetry authentication layer. Because the key is uniform across all default installations and is now publicly disclosed via the vendor's security advisory, any party aware of it can replicate the hashing algorithm offline and produce a cryptographically valid forged API key hash, bypassing the authentication gate entirely without needing access to the original credentials or the underlying key store.
RemediationAI
Upgrade to openssl_encrypt version 1.4.0 or later, which resolves the hardcoded secret key issue per the vendor advisory at https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-p926-6hjp-w9jw. If an immediate upgrade is not possible, operators should override the default secret key in the telemetry server configuration with a cryptographically random, deployment-specific value - this eliminates the predictability that enables the attack, even on unpatched versions. As a secondary compensating control, restrict network access to the telemetry API endpoint to trusted IP ranges using firewall rules or reverse proxy ACLs; note this may impair telemetry collection from legitimate remote sources and does not fix the underlying credential weakness. All active API keys issued under the compromised default key should be rotated after patching, as existing hashes derived from the hardcoded value should be considered untrusted.
More in Openssl Encrypt
View allArbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from i
Fingerprint-verification spoofing in jahlives openssl_encrypt before 1.4.9 lets attackers embed ANSI escape sequences in
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run wit
Arbitrary code execution in jahlives openssl_encrypt before 1.4.0 stems from an inconsistent sandbox: the runtime Plugin
Authentication bypass in the jahlives openssl_encrypt library (all versions before 1.4.0) lets remote unauthenticated at
Authentication brute-force protection can be bypassed in jahlives openssl_encrypt before 1.4.0 because the TOTP rate lim
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break ou
Cryptographic shared-secret disclosure in the openssl_encrypt Python library (maintainer 'jahlives') before 1.4.0 lets a
Sandbox escape leading to remote code execution affects openssl_encrypt (the jahlives Python package) in all versions be
Arbitrary code execution in openssl_encrypt (the jahlives Python encryption utility) before 1.4.9 allows an attacker-sup
Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a den
Sensitive-token exposure in openssl_encrypt (the jahlives Python package, pip 'openssl-encrypt') before 1.4.0 stems from
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today