The vulnerability exists in versions of openssl_encrypt prior to 1.4.0, where the CamelliaCipher implementation disables HMAC tag generation and verification when the PYTEST_CURRENT_TEST environment variable is set. This allows an attacker with code‑execution capabilities to set that environment variable and produce ciphertext that bypasses integrity protection, effectively enabling the creation of data that is not authenticated by the library. The consequence is that tampered data can be accepted and processed without detection, compromising data integrity and potentially allowing further exploitation based on manipulated inputs.

The affected product is OpenSSL Encrypt as maintained by jahlives. All releases before 1.4.0 are vulnerable; versions 1.4.0 and later include the fix that restores proper HMAC generation and verification.

With a CVSS score of 9.3, the vulnerability is considered critical. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that it may not yet be publicly exploited. However, the attack requires that an attacker already has code‑execution privileges to set the PYTEST_CURRENT_TEST environment variable. In environments where such privileges are possible—such as CI pipelines or development machines—this flaw can be leveraged to subvert trust in encrypted data. The lack of an external drive and the focus on environment variable manipulation mean that the exposure is largely limited to contexts where the vulnerable library is used in conjunction with arbitrary code execution.