The vulnerability lies in the authentication logic of the openssl_encrypt library before version 1.4.0, specifically in the pqc.py module. When a decryption failure occurs with AES‑GCM, the code falls back to an unauthenticated AES‑CTR mode. This allows any attacker able to modify ciphertext in transit to bypass integrity checks and perform bit‑flipping attacks on the decrypted data. The weakness is classified as CWE‑347, a type of authentication bypass that undermines confidentiality and integrity of encrypted communications.

Applications that depend on the jahlives:openssl_encrypt PHP library and use it without specifying a newer version will be affected. The issue applies to all releases before 1.4.0 and to any PHP project that imports the library for encryption or decryption operations. System administrators should review PHP code bases that include this package and verify the installed version.

The CVSS score of 9.3 indicates a critical severity. No EPSS value is available, but the absence of a known KEV listing does not diminish the risk. Attackers can exploit the flaw by intercepting or tampering with ciphertext exchanged over an insecure channel, triggering the fallback and enabling undetected data manipulation. The exploitation path is straightforward: alter ciphertext, cause AES‑GCM failure, accept the unauthenticated AES‑CTR result.