This vulnerability causes the openssl_encrypt package, versions 1.4.8 and older, to include the user‑supplied keyserver bearer token in the command‑line debug output that is written to standard error. Because the token is not redacted by the sanitize routine, the bearer token appears in clear text in logs, terminal history, and any observers of the debug stream. An attacker who gains read access to these logs or the live output can obtain the bearer token and subsequently use it to authenticate to the keyserver, potentially allowing unauthorized access to stored keys or other protected resources.

The affected product is the pip package openssl_encrypt, developed by jahlives, with all releases up to and including version 1.4.8 vulnerable. Versions 1.4.9 and later contain a fix that properly sanitises the token.

With a CVSS score of 8.7 the vulnerability is considered High severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog, indicating no publicly known exploit campaigns to date. The likely attack vector is local or remote access to the debug output, such as read access to logs or a compromised terminal session, which could allow the token to be harvested. Once obtained, the token can be reused for credential theft or impersonation. Therefore, the risk is significant for any environment that enables debugging for this package.