openssl_encrypt versions before 1.4.9 do not verify whether private keys embedded in file metadata are encrypted. An attacker can craft a file containing an unencrypted post‑quantum key and present it to the library. Under any supplied password the key decrypts and the library returns attacker‑chosen plaintext while falsely reporting a successful authentication. This flaw allows an attacker to bypass authentication controls and read or write arbitrary decrypted data, exposing confidentiality and potentially enabling further compromise. The weakness is an authentication bypass identified as CWE‑287.

Any installation of jahlives’ openssl_encrypt that uses a release prior to 1.4.9 is susceptible. Users employing earlier versions on production systems should review their configurations.

With a CVSS score of 8.7 the vulnerability is considered high risk. EPSS is not available, so the probability of current exploitation is unknown, but the lack of a KEV listing suggests no widespread exploitation has yet been reported. The attack path requires an attacker to supply a crafted file to the library; therefore it can be triggered locally if the system processes user‑supplied data, or remotely if the application exposing the library accepts uploads or untrusted input. Attackers could therefore bypass authentication and obtain attacker‑controlled plaintext. The lack of known mitigations in the public record means that a formal patch is the most reliable protection.