This vulnerability stems from a weakness in the key derivation function used by openssl_encrypt versions prior to 1.4.0. The implementation of HKDF lacks a salt and uses a static info parameter during key normalization, which limits the entropy that can be extracted from the input. As a result, keys derived from identical inputs are highly deterministic, enabling an attacker to compute cryptographic keys more easily and compromise confidentiality of data protected by the library. The affected weakness is classified as CWE‑326, highlighting insufficient key derivation protocols.

The vulnerable product is the openssl_encrypt library provided by jahlives. All releases before version 1.4.0 are vulnerable. Users who rely on this library for encryption or key generation are at risk until they upgrade to a supported release.

The CVSS base score for this issue is 9.3, categorizing it as critical. While the EPSS score for this vulnerability is not available, the lack of available surface for exploitation suggest that an attacker with the ability to influence key inputs could exploit the predictability. The vulnerability is not currently listed in the CISA KEV catalog. The attack vector is inferred to be remote software exploitation through the use of the deterministic key derivation process in the encrypting code.