The vulnerability resides in the openssl_encrypt Python package, where the configuration file path is mistakenly resolved as a relative name rather than the intended absolute per‑user path. When the legacy Tk GUI launches, it reads and writes its key derivation function settings from a file called crypt_settings.json in the current working directory. An attacker who places a malicious crypt_settings.json file can disable all memory‑hard KDFs, causing the application to perform only a single hash round. This downgrades the encryption strength and makes any resulting ciphertext vulnerable to offline brute‑force attacks.

OpenSSL‑Encrypt, pip package versions up to and including 1.4.8, installed under the name openssl_encrypt. The issue was fixed in 1.4.9 and later releases.

The CVSS score of 8.7 indicates a high severity impact. EPSS data is not available and the vulnerability has not been listed in CISA’s KEV catalog. An attacker who can place a file into the application’s current working directory—through local file accessibility or a file‑upload vector—can exploit the flaw. Once the malicious configuration is loaded, the attacker bypasses the software’s weak‑KDF preflight checks, effectively reducing the computational cost of decrypting stored data to a single hash round and enabling practical offline brute‑force attacks.