The vulnerability exposes a hardcoded default secret key in the openssl_encrypt telemetry server configuration. This key is used to hash API keys, and having the value allows attackers to predict or forge valid API hashes, thereby compromising authentication to the telemetry service. The flaw represents a severe confidentiality and integrity risk for systems that rely on this service and is classified as a CWE‑798 Hardcoded Credentials weakness.

Affected products are versions of openssl_encrypt produced by jahlives that are older than 1.4.0. The hardcoded key resides in the standalone telemetry server configuration and is present in every release prior to the 1.4.0 update.

The CVSS score of 8.7 indicates high severity. With the EPSS score not available, the precise prevalence of exploitation is uncertain, but the lack of a KEV listing suggests it has not been widely observed as a known exploit. A likely attack vector involves an attacker who can communicate with the telemetry API; knowing the hardcoded key, the attacker can generate valid hashed API keys and gain unauthorized access. If the telemetry service is exposed to untrusted networks, remote attackers could readily exploit the flaw, whereas internal actors who have configuration access are also at risk.