Description
openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including client_id, passwords, and JWTs to achieve full keyserver account takeover.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jahlives | openssl_encrypt | < 1.4.9 | 1.4.9 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | openssl-encrypt | < 1.4.9 | 1.4.9 | PYSEC-2026-3797 |
References
- GitHub Security Advisory (GHSA-xr64-hcxg-4ghr) vendor-advisory
- VulnCheck Advisory: openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs third-party-advisory