openssl_encrypt versions before 1.4.9 derive the remote‑pepper wrap key using unsalted HKDF‑SHA256 or bare SHA‑256 of the password, producing identical keys for all users and files. Attackers who obtain wrapped pepper blobs can precompute a single dictionary table and perform fleet‑wide offline password guessing at hardware speed, enabling recovery of user passwords. This vulnerability compromises password confidentiality and permits an attacker to compromise multiple accounts with a single credential guess.

All installations of jahlives:openssl_encrypt that use a version older than 1.4.9 are affected. No specific patch version list is available beyond the fact that any pre‑1.4.9 release must be updated.

The reported CVSS score of 8.7 indicates high severity, while the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires accessibility to the stored pepper blobs; an attacker with that access can offline precompute a dictionary table to recover plaintext passwords on a large scale. The likely attack vector therefore involves privileged or compromised systems that can read the pepper data. Although it requires prior access to the pepper blob, the high CVSS and potential for fleet‑wide credential compromise make this a serious risk for any organization using the affected library.