OpenSSL’s handling of PKCS#12 files that use Password‑Based Message Authentication Code 1 (PBMAC1) fails to verify the integrity of the file when an HMAC key of only one byte is supplied. As a result, a crafted PKCS#12 file can be accepted with a one‑in‑256 probability, allowing an attacker to embed a forged certificate and private key that the processing application will load as if they were legitimate. The vulnerability does not provide direct code execution but enables impersonation and validation bypass for services that rely on PKCS#12 file authentication.

The issue applies to the OpenSSL library, excluding the FIPS module where the affected code resides outside its boundary. No specific product versions are listed, so all releases of OpenSSL that implement PBMAC1 handling are potentially vulnerable.

The vulnerability’s CVSS score is 7.4, and its EPSS score is < 1%. A crafted PKCS#12 file with a one‑byte HMAC key is accepted with a 1 in 256 probability, giving an attacker the ability to embed a forged certificate and private key. Because the impact is the ability to impersonate a user through a forged credential, the risk is moderate if the application accepts arbitrary PKCS#12 files. The vulnerability is not currently listed in the CISA KEV catalog, and no public exploitation examples are known. The likely attack vector involves supply or upload of a malicious PKCS#12 file to a service that processes such files without additional validation.