The vulnerability in jahlives openssl_encrypt prior to version 1.4.0 arises from a missing ownership verification check in the revoke_key method. This flaw permits an authenticated client to revoke arbitrary keys of other clients by supplying a valid ML-DSA signature, effectively bypassing the intended ownership controls. The CVSS 4.0 score is 8.7, indicating a high impact with network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, and availability.

An attacker with authenticated access and a valid ML-DSA signature can revoke keys belonging to other clients, potentially disrupting service or causing denial of key-based operations. This bypasses intended ownership restrictions, leading to unauthorized key revocation and associated impacts on confidentiality, integrity, and availability of cryptographic operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Until a patch is available, restrict authenticated client access and monitor for suspicious key revocation activities.