The vulnerability stems from IBM Langflow OSS using Python's non‑cryptographic random module to generate Fernet encryption keys from user secrets shorter than 32 characters. Because the Mersenne Twister PRNG is deterministic, identical seeds produce identical keys, allowing an attacker to reconstruct the encryption key and decrypt stored API keys and authentication tokens. This weakness corresponds to CWE‑327 and results in the exposure of sensitive data.

Affected products are IBM's Langflow OSS versions 1.0.0 through 1.10.3. The issue applies to all releases within that range, as enumerated in the CNA data. Users running these versions should verify their installation against the fixed releases listed in the vendor's GitHub repository.

The CVSS score of 7.4 indicates a high severity level, while no EPSS information is available. Because the vulnerability revolves around user‑supplied secrets that are less than 32 characters, an attacker can exploit the determinism by supplying the same secret during the application’s initialization or via an API request, reproducing the encryption key. Successful exploitation would permit the attacker to decrypt stored credentials, potentially compromising downstream services that rely on those API keys or tokens. The vulnerability is not indexed in the CISA KEV catalog, but the absence of an EPSS score does not preclude exploitation, especially in environments where the application is exposed to untrusted input.