The vulnerability in jahlives openssl_encrypt prior to version 1.4.0 involves insufficient verification of data authenticity due to a default configuration that implicitly trusts all RFC 1918 private IP addresses as trusted proxies. This configuration flaw enables an attacker within a private network to forge client certificate headers, effectively bypassing mTLS authentication mechanisms if ProxyAuth validation is not strictly enforced. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity, with network attack vector, low attack complexity, and no required privileges or user interaction. There is no official remediation or patch currently documented.

An attacker on a private network can exploit this vulnerability to bypass mTLS authentication by forging client certificate headers, potentially gaining unauthorized access to systems relying on this authentication method. This undermines the integrity of authentication and could lead to unauthorized access or impersonation within affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid relaxing or modifying ProxyAuth validation and should not rely on the default trusted_proxies configuration that trusts the entire RFC 1918 private address space. Implement strict validation of client certificates and proxy authentication settings to mitigate the risk.