openssl_encrypt versions prior to 1.4.0 embed hard‑coded PostgreSQL credentials in server configuration files. An attacker who can reach the same network segment can use those predictable defaults to log in as a database user and read or modify stored data. The flaw primarily jeopardizes data confidentiality and, if the compromised account has higher privileges, could lead to broader system impact.

The issue affects the jahlives:openssl_encrypt product and all its releases before the 1.4.0 update. Systems running any older version that deploys the bundled configuration files are vulnerable. No specific version range is listed beyond "before 1.4.0.",

The CVSS score of 8.7 classifies this vulnerability as High severity. Exploitation requires the attacker to be on the same local network where the bundled configuration files are used to connect to PostgreSQL. EPSS data is not available, and the vulnerability is currently not listed in the CISA KEV catalog, suggesting limited known exploitation. The attack path involves sending a standard login request to the PostgreSQL server using the exposed default credentials, which, if successful, grants read or write privileges according to the account’s configured rights.