The vulnerability in jahlives openssl_encrypt prior to version 1.4.0 involves an in-memory rate limiter designed to protect against TOTP brute-force attacks. This rate limiter is not synchronized across multiple server workers and is lost when the server restarts. Consequently, attackers can circumvent the rate limiting by spreading attempts across different server instances or by retrying after a restart, effectively allowing unlimited authentication attempts.

Attackers can bypass the intended brute-force protection mechanism, potentially enabling them to perform unlimited authentication attempts against TOTP-protected endpoints. This increases the risk of unauthorized access through brute-force attacks. The vulnerability has a high CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing external or centralized rate limiting mechanisms that persist across server instances and restarts to mitigate brute-force attempts.