The vulnerability in openssl_encrypt prior to version 1.4.0 stems from its use of an in-memory rate limiter for TOTP brute-force protection that is not synchronized across multiple server workers and is lost upon server restart. This design flaw enables attackers to circumvent rate limiting by spreading authentication attempts across different server instances or by retrying immediately after a server restart, effectively allowing unlimited brute-force attempts.

Attackers can bypass the intended brute-force protection mechanisms, potentially enabling unauthorized access through repeated TOTP authentication attempts without effective throttling. This could lead to compromise of accounts protected by TOTP authentication relying on the affected openssl_encrypt versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing external, centralized rate limiting mechanisms that persist across server workers and restarts to mitigate brute-force attempts.