OpenSSL’s handling of PKCS#12 files that use Password‑Based Message Authentication Code 1 (PBMAC1) fails to verify the integrity of the file when an HMAC key of only one byte is supplied. As a result, a crafted PKCS#12 file can be accepted with a one‑in‑256 probability, allowing an attacker to embed a forged certificate and private key that the processing application will load as if they were legitimate. The vulnerability does not provide direct code execution but enables impersonation and validation bypass for services that rely on PKCS#12 file authentication.

The issue applies to the OpenSSL library, excluding the FIPS module where the affected code resides outside its boundary. No specific product versions are listed, so all releases of OpenSSL that implement PBMAC1 handling are potentially vulnerable.

The vulnerability’s CVSS score is not publicly disclosed, and an EPSS score is unavailable, but the exploit probability is explicitly quantified as a 1 in 256 chance for the forged file to be accepted. Because the impact is the ability to impersonate a user through a forged certificate and key, the risk is moderate if the application accepts arbitrary PKCS#12 files. The vulnerability is not currently listed in the CISA KEV catalog, and no public exploitation examples are known. The likely attack vector involves supply or upload of a malicious PKCS#12 file to a service that processes such files without additional validation.