The vulnerability CVE-2026-74892 affects versions of jahlives' openssl_encrypt prior to 1.4.0. A hardcoded default secret key is embedded in the standalone telemetry server configuration and is used for hashing API keys. This predictable secret allows attackers to forge or predict valid API key hashes, thereby bypassing authentication controls on the telemetry API. The CVSS 4.0 score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality.

Successful exploitation allows attackers to compromise telemetry API authentication by predicting or forging API key hashes. This can lead to unauthorized access to telemetry data or functionality protected by the API keys. The vulnerability does not require privileges or user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor the vendor's announcements for updates. Until a fix is available, avoid using the vulnerable versions in sensitive environments or consider mitigating exposure by restricting network access to the telemetry API.