The vulnerability originates from the import of Python's non‑cryptographic 'random' module in a cryptographic library prior to release 1.4.0. Although no cryptographic functions directly call the module, its presence creates a path for developers to mistakenly use functions such as random.randint() instead of a secure source, potentially compromising the randomness of sensitive data. The immediate impact is a future‑risk constraint rather than an active attack vector; the risk is that predictable outputs could be reproduced if the Mersenne Twister state is partially exposed.

The issue affects the Jahlives openssl_encrypt project, specifically all versions before 1.4.0. Users deploying those releases are at risk if they import or reference the random module in subsequent code paths.

The CVSS score of 9.3 indicates a high severity, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, implying no reported active exploitation. The likely pathway for exploitation requires a future developer to adopt the insecure random methods, so timely remediation mitigates the risk before it can be exploited.