The vulnerability arises from the OECH1 prefix encoding, designed for obfuscation but found to be cryptographically weak. Because of this weakness, any values encoded with OECH1—including credentials and secrets—can be retrieved by attackers who can analyze the encoded data. This can lead to exposure of sensitive data, such as passwords, compromising account integrity and system confidentiality.

The flaw affects Progress Software Corporation's OpenEdge platform. All instances that rely on OECH1 prefix encoding for protecting values are susceptible. No specific version details are supplied, so any OpenEdge deployment using OECH1 should be considered at risk.

The CVSS score of 9.1 indicates a critical severity, reflecting a serious risk when the encoding is used. The EPSS score is not available, but the lack of KEV listing suggests it is not yet widely exploited. Inferred, the likely attack vector involves an adversary with read access to the database or configuration files that contain OECH1-encoded data, enabling them to decode and recover the original values. The vulnerability does not require special privileges beyond access to stored data, making it both highly impactful and relatively easy to exploit if access is obtained.