The vulnerability arises from an insecure default configuration in openssl_encrypt versions prior to 1.4.0 that trusts all IP addresses in the RFC 1918 private address space as trusted proxies for IntegrityProxyConfig. Attackers on a private network can forge client certificate headers, thereby bypassing mutual TLS authentication when the proxy authentication validation is relaxed or modified. This enables the attacker to impersonate legitimate clients and gain unauthorized access to services that rely on mTLS, potentially exposing sensitive data or allowing further lateral movement within the protected network.

Vendor jahlives, product openssl_encrypt, affected by all releases before version 1.4.0. No other product variants are identified; only the stated range is impacted.

The CVSS score of 8.7 indicates a high severity level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no confirmed public exploitation yet. The likely attack vector involves an insider or attacker within a private network who can send traffic with forged headers to a system configured with the insecure defaults. Successful exploitation would result in authentication bypass for services behind the proxy, potentially granting the attacker full access to those services.