The vulnerability resides in a hardcoded default secret for JWT signing in versions of openssl_encrypt prior to 1.4.0. Because the secret bypasses validation checks, an attacker who can read the source code can create valid JWT tokens for any client_id. The forged tokens provide authenticated access to the keyserver and telemetry APIs, effectively allowing the attacker to impersonate any user within the system. The weakness is a hard‑coded credential, classified as CWE‑798.

The affected product is the jahlives openssl_encrypt library in all releases before version 1.4.0.

The CVSS score of 8.7 indicates a high severity. EPSS data is not available, so the likelihood of exploitation is unknown, but the flaw requires source‑code access, implying that an attacker must have compromised a developer environment or accessed the code repository. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Nonetheless, the potential for widespread token forgery makes the risk significant for any deployment that relies on the vulnerable library for JWT authentication.