The vulnerability CVE-2026-74871 affects jahlives' openssl_encrypt versions before 1.4.6. It involves a key derivation flaw in the sequential XOR composition mode where the final stage cancels out during key generation. When the encryption is configured with a single KDF and lacks a prior hashing stage, attackers can bypass the memory-hard key derivation process. This results in offline password cracking being performed at the speed of SHA-256 rather than the configured, more computationally expensive KDF, reducing the effort required to recover passwords.

The impact of this vulnerability is that attackers can perform offline password cracking more efficiently than intended, reducing the computational effort from the configured KDF cost to that of SHA-256 speed. This weakens the protection of encrypted data by making brute-force or dictionary attacks more feasible. There is no indication of remote exploitation or privilege escalation; the attack vector is local (AV:L).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Users should monitor vendor communications for updates. Until a fix is available, avoid configurations that use a single KDF without a prior hashing stage in sequential XOR composition mode.