The vulnerability CVE-2026-74893 affects jahlives' openssl_encrypt product versions prior to 1.4.0. It involves the use of hardcoded default JWT signing secrets embedded in the config.py file. Because these secrets pass validation, an attacker who can access the source code can create forged JWT tokens for arbitrary client_ids. This enables unauthorized authenticated access to sensitive APIs such as keyserver and telemetry endpoints. The CVSS 4.0 score is 8.7, indicating a high severity vulnerability with network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, and availability.

Attackers with source code access can forge valid JWT tokens to impersonate any client_id, gaining authenticated access to keyserver and telemetry APIs. This compromises confidentiality, integrity, and availability of these services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing source code containing hardcoded JWT secrets and consider rotating any default secrets if possible.