The vulnerability in jahlives openssl_encrypt prior to version 1.4.0 arises from a missing ownership verification check in the revoke_key method. Authenticated users can exploit this flaw by providing a valid ML-DSA signature to revoke arbitrary keys, circumventing the intended restriction that only allows revocation of their own keys. This authorization bypass can disrupt key management and potentially impact security controls relying on key validity.

An attacker with authentication can revoke keys of other clients, potentially disrupting their ability to use encrypted communications or services relying on those keys. This could lead to denial of service or other security impacts related to key management. The CVSS 4.0 score of 8.7 indicates high severity, reflecting the network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated client permissions to minimize exposure and monitor for unusual key revocation activity. Avoid relying solely on client-side key revocation requests without additional verification.