The vulnerability in jahlives openssl_encrypt before version 1.4.0 involves improper verification of cryptographic signatures in the PublicKeyBundle.from_dict() function. This function creates key bundles from untrusted input without validating the signatures, enabling attackers to invoke from_dict() followed by to_identity() to encrypt data with malicious public keys. This can result in leakage of sensitive information. The CVSS 4.0 score is 9.3, indicating a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Exploitation of this vulnerability can lead to unauthorized encryption of data using attacker-controlled keys, which may cause leakage of secrets and compromise confidentiality. The flaw affects the cryptographic trust model of the product, potentially undermining secure communications or data protection relying on these keys.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is provided in the available data. Users should monitor the vendor's announcements for patches addressing this issue.