The vulnerability stems from a misconfigured Cross-Origin Resource Sharing (CORS) policy in openssl_encrypt versions prior to 1.4.0. The API allows any origin via a wildcard "allow_origins" setting while simultaneously permitting credentialed requests through "allow_credentials" enabled. An attacker can host a malicious site that tricks users into loading it; the browser will then automatically include the user’s authentication tokens while making requests to the vulnerable API, effectively allowing the attacker to perform actions and exfiltrate data with the user’s privileges. This flaw satisfies CWE-942, underscoring the dangerous interplay of open origins and credential sharing.

The affected product is jahlives:openssl_encrypt and any deployments utilizing versions earlier than 1.4.0. Only these releases inherit the default CORS configuration that leads to the wildcard origin with credential support. Upgrading to or patching against version 1.4.0 removes the risky defaults or requires explicit origin whitelisting.

The CVSS score of 7.1 reflects a moderate-to-high risk, primarily due to the ease with which an attacker can craft a malicious web page to provoke a credentialed cross-origin request. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the absence of these indicators does not diminish the practical likelihood of exploitation. Attackers need only control a malicious front-end site; no additional steps like code execution or privileged access are required, making this vulnerability attractive for phishing or data‑exfiltration campaigns.