The vulnerability in jahlives openssl_encrypt prior to version 1.4.0 arises from insufficient verification of data authenticity in the CamelliaCipher encryption mode. When the PYTEST_CURRENT_TEST environment variable is set, the HMAC tag generation and verification are disabled, effectively bypassing the integrity checks on encrypted data. This flaw allows attackers who can execute code to generate ciphertext that lacks proper authentication, undermining the cryptographic assurances normally provided by the library.

Attackers with the ability to execute code on the affected system can exploit this vulnerability to bypass integrity protection on encrypted data by disabling HMAC authentication. This compromises the authenticity and integrity guarantees of encrypted communications or stored data, potentially allowing tampering or injection of malicious content without detection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid setting the PYTEST_CURRENT_TEST environment variable in production environments and restrict code execution privileges to trusted users only.