The vulnerability CVE-2026-74893 affects jahlives openssl_encrypt versions prior to 1.4.0. It arises from the presence of hardcoded default JWT signing secrets in the config.py file that pass validation checks. An attacker who can access the source code can exploit this by forging valid JWT tokens for arbitrary client_ids, thereby gaining authenticated access to keyserver and telemetry APIs. This flaw compromises authentication mechanisms relying on JWT tokens.

Exploitation of this vulnerability allows an attacker with source code access to generate valid JWT tokens for any client_id, resulting in unauthorized authenticated access to keyserver and telemetry APIs. This can lead to unauthorized data access and potential manipulation of telemetry data or keyserver operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been documented as of the published date. Until a patch is available, restrict access to the source code to prevent attackers from obtaining the hardcoded secrets and consider implementing additional authentication controls or rotating JWT signing secrets if possible.