The vulnerability in jahlives openssl_encrypt versions before 1.4.0 stems from an insecure default configuration that implicitly trusts all private IP addresses defined by RFC 1918 within the IntegrityProxyConfig trusted_proxies. This trust model enables attackers located on private networks to forge client certificate headers. When ProxyAuth validation is relaxed or altered, these forged headers can bypass mTLS authentication, potentially allowing unauthorized access. The CVSS 4.0 base score is 8.7, indicating a high impact with network attack vector, low complexity, and no required privileges or user interaction. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

Attackers on private networks can exploit this vulnerability to bypass mTLS authentication by forging client certificate headers, potentially gaining unauthorized access to systems relying on openssl_encrypt's IntegrityProxyConfig trusted_proxies. This undermines the integrity of authentication mechanisms in affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid relaxing or modifying ProxyAuth validation and restrict trusted proxies configurations to minimize exposure to private network attackers.