The vulnerability resides in openssl_encrypt, a Python package, where diagnostic commands that were meant for hardware pepper testing – specifically 'hsm fido2-test' and 'hsm onlykey-test' – automatically print the full derived hardware pepper as a hexadecimal string to standard output and standard error. The displayed value can be captured in terminal scrollback, session recordings, or continuous‑integration logs. Because the pepper is derived from a randomly generated per‑invocation salt and is salt‑bound, an attacker who learns its value cannot use it to decrypt actual data; thus the impact is limited to the disclosure of internal testing information.

Affected by the jahlives openssl_encrypt package. All releases up to and including version 1.4.7 are vulnerable. The fix was applied in release 1.4.8 and later, including 1.5.0. No other vendors or product lines were identified in the CNA data.

The CVSS score of 8.7 classifies the issue as high severity. Although the EPSS score is not available, the exploit is plausible because the vulnerable commands are part of the published code base and can be executed by anyone who has access to the application, whether locally or through an automated workflow. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread active exploitation is reported. Nonetheless, the automated printing of cryptographic material to logs represents a non‑negligible risk in regulated or sensitive environments, where log retention policies could allow a third party to see the pepper value.