Based on the description, it is inferred that an empty ciphertext supplied to EVP_Cipher() for ChaCha20‑Poly1305 or AES‑OCB bypasses the authentication tag verification step, so the decryption call can succeed without confirming tag validity. This flaw lets an attacker craft forged messages that appear authenticated, compromising data integrity and potentially enabling further tampering or malicious data injection.

Based on the description, it is inferred that the vulnerability is triggered when the application passes an empty ciphertext to this routine, affecting all installations of OpenSSL that provide ChaCha20‑Poly1305 or AES‑OCB decryption and expose the EVP_Cipher() API, regardless of specific major release.

Based on the description, it is inferred that the attack vector involves an attacker supplying an empty ciphertext to an application that internally calls EVP_Cipher(). The exploit requires the ability to submit an empty ciphertext to an application that internally calls EVP_Cipher(). The EPSS score is < 1% and the vulnerability is not listed in CISA KEV, indicating limited observed exploitation. However, the lack of authentication tag verification presents a clear integrity threat, especially for protocols or services that rely on these ciphers for secure communication. The CVSS score is 9.1, reflecting a high severity risk that quantifies the potential impact of forging AEAD tags.