The vulnerability arises from an incorrect BouncyCastle transformation string within Steeltoe.Configuration.Encryption versions 4.0.0 through 4.1.0. When a configuration sets encrypt:rsa:algorithm=OAEP, the library mistakenly uses PKCS#1 v1.5 padding—the same as the DEFAULT setting. This means data intended to be protected with the more secure OAEP scheme is instead encrypted with a weaker algorithm, exposing it to cryptanalytic attacks. The weakness is related to incorrect encryption handling (CWE‑256) and the use of an insecure cryptographic algorithm (CWE‑327).

Affected products include Steeltoe.Configuration.Encryption 4.0.0 to 4.1.0 used in cloud‑native applications built with the Steeltoe OSS libraries. Any system that imports the vulnerable library and relies on RSA encryption for secrets, configuration payloads, or data protection is potentially impacted. The vulnerability is patched in Steeltoe.Configuration.Encryption 4.2.0.

The CVSS score of 1.9 and an EPSS score below 1 % indicate a low overall risk to most environments, and the vulnerability is not listed in CISA KEV. Nevertheless, because the flaw weakens cryptographic guarantees, attackers who can capture encrypted data may recover the plaintext. The misconfiguration is local to the application layer; no network‑level exploit is required, but the impact is a loss of confidentiality for the data encrypted by the affected library.