CVE-2026-74892 describes a security vulnerability in the jahlives project's openssl_encrypt component prior to version 1.4.0. The vulnerability arises from the use of a hardcoded default secret key in the telemetry server configuration, which is used for hashing API keys. An attacker aware of this default key can generate or predict valid API key hashes, thereby bypassing authentication controls for the telemetry API. The CVSS 4.0 base score is 8.7, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality.

The vulnerability enables attackers to compromise telemetry API authentication by forging or predicting API key hashes due to the hardcoded secret key. This can lead to unauthorized access to telemetry data or functionality protected by the API keys. There is no indication of privilege escalation or impact on integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated, users should monitor the vendor's announcements for updates. Until a fix is available, avoid deploying vulnerable versions in sensitive environments or consider mitigating exposure by restricting access to the telemetry API.