jahlives vulnerabilities and threats

openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules.

openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header.

openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any client_id to gain authenticated access to keyserver and telemetry APIs.

openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication.

openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data.

openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTEST_CURRENT_TEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticated ciphertext and bypass integrity protection on encrypted data.

openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks.

openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords protecting legacy encrypted files compared to standard PBKDF2 implementations.

openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PRNG) at line 15 of openssl_encrypt/modules/pqc.py. No direct calls to random.* were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that future code could inadvertently use random.randint() instead of a cryptographically secure alternative (secrets/os.urandom), producing predictable values since the Mersenne Twister state can be recovered from approximately 624 outputs. Fixed by removing the import in 1.4.0.

openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUS_MODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous modules like sys, shutil, multiprocessing, importlib, and pickle for arbitrary code execution.

openssl_encrypt versions before 1.4.0 contain a logging bug in restore_hidden_modules() that logs module counts after clearing, always showing zero restored modules and corrupting audit trails. Additionally, a race condition exists between module hiding and import hook installation where another thread could re-import blocked modules in multi-threaded environments.

openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the plugin_id parameter is not sanitized before constructing the plugin config directory path. Attackers can declare a malicious plugin_id containing path traversal sequences like '../' to access arbitrary directories outside the intended plugin directory.

openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pathlib.Path and io.open. Attackers can import pathlib or io modules to read and write arbitrary files, completely bypassing the restricted_open file access controls.

openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation is relaxed or modified.

CVE-2026-74881 affects jahlives openssl_encrypt versions before 1.4.0, where the Cross-Origin Resource Sharing (CORS) policy is configured permissively with a wildcard allow_origins and allow_credentials set to true. This misconfiguration allows attackers to craft malicious websites that can make authenticated cross-origin requests to the API on behalf of users who visit these sites.

CVE-2026-74880 is a critical vulnerability in jahlives openssl_encrypt versions before 1.4.0 where refresh tokens are accepted as URL query parameters in keyserver and telemetry server routes. This design allows attackers to extract sensitive tokens from server logs, proxy logs, browser history, and HTTP Referer headers, potentially leading to unauthorized access.

A vulnerability in jahlives openssl_encrypt versions before 1.4.0 allows unauthenticated attackers to obtain sensitive information via error messages from the /ready endpoint. The endpoint returns full database exception strings that may include hostnames, IP addresses, connection parameters, and possibly credentials. This information disclosure can be triggered by causing database errors. The vulnerability has a high severity with a CVSS score of 8.7.

CVE-2026-74878 is a critical vulnerability in jahlives openssl_encrypt versions before 1.4.0. The vulnerability arises from an in-memory rate limiter used for TOTP brute-force protection that is not shared across server workers and resets on server restart. This allows attackers to bypass rate limiting by distributing authentication attempts across multiple server instances or retrying immediately after a restart.

A vulnerability in jahlives openssl_encrypt versions before 1.4.0 allows authenticated clients to revoke keys belonging to other clients due to missing ownership verification in the revoke_key method. This authorization bypass can be exploited by providing a valid ML-DSA signature, enabling attackers to revoke arbitrary keys.

A critical vulnerability (CVE-2026-74876) exists in jahlives openssl_encrypt versions before 1.4.0. The flaw is in the PublicKeyBundle.from_dict() function, which creates key bundles from untrusted data without verifying cryptographic signatures. This allows attackers to encrypt data using attacker-controlled public keys, potentially leaking secrets.