The vulnerability in the openssl_encrypt Python package stores an mTLS client private key in plaintext within a world‑readable file when using package versions 1.4.8 and earlier. A local attacker who can read the device's file system may retrieve the private key, potentially compromising all communications protected by that key. This flaw is a classic case of improper data storage, mapped to CWE‑312.

It affects the jahlives openssl_encrypt package, versions 1.4.8 and earlier, and can be mitigated by installing version 1.4.9 or later, which writes the key to a private 0600 file and only keeps the file path in SharedPreferences.

The CVSS score of 8.6 indicates high severity, and although an EPSS score is unavailable, the weakness remains significant for users who store keys locally without proper file permissions. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires legitimate file system access on the target device, making it a local‑but‑not‑remote attack. As the fix creates a dedicated private file and cleans previous cleartext entries, users should promptly upgrade, especially if the package remains at an older version.