opens ssl encrypt before 1.4.0 contains a missing ownership verification vulnerability in its revoke_key method that allows an authenticated client to revoke any other client's key. This flaw, classified as CWE-639, enables an attacker to disable or invalidate a peer's cryptographic material without permission. The loss of that key can lead to denial of service, forced key rotation, or loss of access to protected data. The attack does not directly expose plaintext but can disrupt normal operation by invalidating legitimate keys.

This vulnerability affects the open‑source project jahlives:openssl_encrypt versions earlier than 1.4.0. No specific OS or environment constraints are listed, so any deployment that allows users to call revoke_key may be impacted.

The CVSS score of 8.7 classifies this as a high‑severity flaw. Exploitation requires an authenticated client capable of producing a valid ML‑DSA signature; the attacker can then supply a signature that belongs to another user. While the EPSS score is not available, the high CVSS indicates significant risk. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. The attack vector is inferred to be an authenticated, insider type, given the requirement of a valid signature.