The vulnerability in jahlives openssl_encrypt prior to version 1.4.0 arises from improper verification of cryptographic signatures. Specifically, when AES-GCM decryption fails, the system falls back to AES-CTR mode without authentication, enabling attackers to alter ciphertext without detection. This bypass of integrity checks can lead to bit-flipping attacks, compromising data confidentiality and integrity.

An attacker can modify encrypted data in transit without detection due to the fallback to unauthenticated AES-CTR mode. This compromises the integrity of the encrypted data, allowing bit-flipping attacks that can alter plaintext upon decryption. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Users should monitor the vendor's communications for updates and avoid using affected versions if possible.