The vulnerability in jahlives openssl_encrypt versions prior to 1.4.0 is due to the absence of enforced JSON schema validation when the jsonschema library is missing. This allows attackers to bypass schema validation by either uninstalling the jsonschema package or submitting metadata with unknown format versions, resulting in acceptance and processing of malformed or malicious metadata. This undermines the integrity checks intended by the schema validation mechanism.

The impact of this vulnerability is high as it allows attackers to bypass critical data authenticity checks, potentially leading to processing of malicious data. This can compromise the security guarantees of the openssl_encrypt library, affecting confidentiality and integrity of encrypted data operations. The CVSS 4.0 score of 9.3 reflects critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, ensure the jsonschema package is installed and present in the environment to enforce schema validation. Avoid removing or disabling the jsonschema dependency to prevent bypass of validation checks.