The vulnerability in jahlives openssl_encrypt prior to version 1.4.0 involves the use of GET request methods that include sensitive refresh tokens as URL query parameters in keyserver and telemetry server routes. Because URLs with query parameters can be logged or exposed in various places such as server logs, proxy logs, browser history, and HTTP Referer headers, attackers can obtain these tokens and use them to gain unauthorized access. The CVSS 4.0 score of 9.3 reflects the critical nature of this vulnerability with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Attackers who obtain refresh tokens from logs or browser histories can use them to impersonate legitimate users or services, leading to unauthorized access and potential compromise of sensitive data or system functions. The vulnerability affects confidentiality, integrity, and availability of the affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using GET requests with sensitive tokens in URL query parameters. Consider using POST requests or other secure methods to transmit sensitive data. Monitor for updates from the vendor regarding patches or official mitigations.