OpenSSL's one‑shot EVP_Cipher API silently discards the caller‑supplied IV for AES‑OCB, causing every message to use the same nonce. The reuse of (key, nonce) breaks confidentiality and allows an attacker to create matching authentication tags for arbitrary ciphertext. The flaw arises from improper handling of the IV in the AEAD implementation, categorized as improper key/IV usage.

Any installation of OpenSSL that enables the AES‑OCB provider and that uses EVP_Cipher to encrypt or decrypt data is affected. The vulnerability is present regardless of the OpenSSL version, as long as AES‑OCB is supported; no specific version range is listed. Applications that rely solely on the documented streaming API (EVP_CipherUpdate/EVP_CipherFinal_ex) or that use libssl/TLS are not impacted. The FIPS module versions are not affected because AES‑OCB falls outside the FIPS boundary.

The vulnerability is severe because a compromised or intentionally malicious application can reuse the same key and generate a deterministic tag that accepts any ciphertext for that key/IV pair. An attacker can read multiple cipher texts and forge new ones, effectively breaking confidentiality. There is no current EPSS score, and it is not listed in CISA's KEV catalog, but the unchecked IV handling and key/nonce reuse make it a high‑risk flaw. The attack requires code that uses the EVP_Cipher API with AES‑OCB; local or privileged application access is enough to exploit. The risk is mitigated if the application never uses the vulnerable API path.