CVE-2026-81691: Cleartext Transmission of Sensitive Information in jahlives openssl_encrypt

The vulnerability CVE-2026-81691 affects jahlives openssl_encrypt versions prior to 1.4.9. The issue arises because the software does not validate server URLs properly in the login and register_with_email functions, allowing unencrypted HTTP URLs and unconfigured hosts to be accepted. This results in sensitive information, including client_id, passwords, and JWT tokens, being transmitted in cleartext over the network. An attacker positioned on the network path can intercept these credentials, leading to a complete compromise of the keyserver account. The CVSS 4.0 base score is 8.7, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact.

Attackers with network access can intercept cleartext credentials and tokens, enabling full takeover of affected keyserver accounts. This compromises confidentiality and account integrity, potentially allowing unauthorized access and control.

A fix is available in jahlives openssl_encrypt version 1.4.9 and later. Users should upgrade to version 1.4.9 or newer to ensure proper validation of server URLs and prevent cleartext transmission of sensitive information.