The vulnerability in jahlives openssl_encrypt before version 1.4.0 is due to a permissive CORS configuration where allow_origins is set to wildcard and allow_credentials is enabled. This configuration allows any external domain to send authenticated requests to the API, potentially enabling cross-origin attacks that leverage the victim's authenticated session. The CVSS 4.0 score is 7.1, indicating a high severity issue with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality. No official remediation or patch information is provided in the vendor data.

An attacker can exploit this vulnerability by hosting a malicious website that makes authenticated cross-origin requests to the vulnerable API using the credentials of any user who visits the malicious site. This can lead to unauthorized actions or data exposure through the API, compromising user confidentiality and potentially integrity. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to avoid using versions of jahlives openssl_encrypt prior to 1.4.0 or to manually configure CORS policies to restrict allow_origins to trusted domains and disable allow_credentials if not necessary. Monitor vendor channels for updates and patches.