The vulnerability in jahlives openssl_encrypt prior to version 1.4.0 involves an insecure CORS configuration where allow_origins is set to '*' (wildcard) and allow_credentials is enabled. This combination permits cross-origin requests with user credentials, enabling attackers to perform unauthorized actions by leveraging authenticated sessions of users who visit malicious websites. The CVSS 4.0 score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality.

An attacker can exploit this vulnerability by hosting a malicious website that triggers authenticated cross-origin requests to the vulnerable API, potentially accessing or manipulating sensitive user data without authorization. This compromises user confidentiality and can lead to unauthorized actions performed in the context of the victim's session.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or update is available, it is recommended to avoid using versions of openssl_encrypt prior to 1.4.0 or to manually configure CORS policies to restrict allow_origins to trusted domains and disable allow_credentials if not necessary.