The vulnerability in jahlives openssl_encrypt versions before 1.4.6 arises from a key derivation flaw in the sequential XOR composition mode. Specifically, the last stage of key generation cancels out, which when combined with a configuration using a single key derivation function (KDF) and no prior hashing stage, allows attackers to bypass the memory-hard key derivation process. This reduces the computational effort required to crack passwords offline to the speed of SHA-256 hashing instead of the configured, presumably more computationally expensive, KDF. This weakness can significantly reduce the time and resources needed for offline password cracking attacks.

Attackers can perform offline password cracking attacks more efficiently by bypassing the intended memory-hard key derivation function. This reduces the computational cost to that of SHA-256 hashing speed, potentially allowing attackers to recover passwords faster than expected. The vulnerability does not require user interaction or privileges and is exploitable locally. There are no known exploits in the wild as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated, users should monitor the vendor's communications for updates. Avoid configurations that use a single KDF without a prior hashing stage as a temporary mitigation until a fix is available.