The version of the software fails to verify that the server URL supplied during login or registration is secure. As a result, the system accepts unencrypted HTTP URLs or hosts that have not been explicitly configured. When this occurs, all credentials transmitted—client identifiers, user passwords, and JSON Web Tokens—are sent in clear text. An attacker who can observe the network traffic can capture these credentials and use them to compromise the key management account fully. The weakness corresponds to CWE-319, improper restriction of communications to secure protocols.

The affected product is openssl_encrypt, versions prior to 1.4.9, maintained by the jahlives organization. No additional vendor or product variants are listed in the advisory.

The vulnerability carries a CVSS score of 8.7, indicating high severity. The EPSS score is not provided, so the current exploitation probability cannot be quantified, but the issue is listed in KEV as not included, suggesting no confirmed exploits yet. Based on the description, the likely attack path involves an adversary positioned on the same network path as the client, intercepting unsecured HTTP traffic containing credentials. Control over this traffic is sufficient to carry out a full takeover of the keyserver account.