The flaw resides in the openssl_encrypt implementation before version 1.4.0. An in‑memory rate limiter intended to limit TOTP brute‑force attempts is not shared across workers and is cleared when a server restarts. Attackers can therefore disperse login attempts across multiple server instances or simply retry immediately after a restart, effectively resetting the limiter. This allows continuous authentication attempts without triggering the rate‑limits, exposing the system to rapid credential guessing. The weakness is a lack of globally enforced rate limiting (CWE‑770).

The vulnerability affects the jahlives:openssl_encrypt library in any deployed version earlier than 1.4.0. Any application that relies on this library for TOTP authentication or similar token verification is impacted, regardless of the host operating system or environment.

With a CVSS score of 9.3, the vulnerability is deemed critical. The EPSS score is unavailable, and it is not listed in the CISA KEV catalog. The flaw allows attackers to evade the in‑memory TOTP brute‑force rate limiter by distributing attempts across multiple server instances or retrying immediately after a server restart, effectively resetting the limiter. Because the limiter is only in memory and not shared, there are no additional controls needed to exploit this. Any environment that receives authentication requests and uses an unpatched version of openssl_encrypt is vulnerable to repeated, unthrottled attempts.