The vulnerability occurs when openssl_encrypt writes the decoding password to standard error during a debug run, but it fails to redact the password for certain short or abbreviated option spellings such as -apHunter2 or --passw. Because these spellings bypass the sanitization logic that only recognizes exact option names, the cleartext password is recorded in the debug output, exposing it to anyone who can read that output. This is a cleartext storage of credentials flaw identified as CWE‑532.

The affected product is openssl_encrypt from jahlives. Versions prior to 1.4.9 contain the bug; upgrading to v1.4.9 or later removes the leak.

The CVSS score of 8.7 indicates high severity. No EPSS score is available and the vulnerability is not listed in CISA KEV. Attackers can exploit the flaw on any system that runs openssl_encrypt with debug enabled and where the debugging output is accessible, such as terminal scrollback, combined stdout/stderr, CI job logs, or persistent GUI logs. The risk is primarily confidentiality loss of the password, which could enable further unauthorized access if the password grants privileged permissions.