The vulnerability in jahlives openssl_encrypt versions before 1.4.0 involves the use of HKDF in key normalization functions without a salt and with a static info parameter. This design flaw reduces the entropy extracted during key derivation and results in deterministic outputs for identical inputs. Consequently, attackers can predict derived keys, weakening the cryptographic strength and enabling multi-target attacks that compromise confidentiality.

The predictable key derivation due to inadequate entropy extraction significantly weakens the cryptographic security of the openssl_encrypt function. This can lead to attackers successfully performing multi-target attacks by exploiting identical inputs to derive keys, potentially compromising encrypted data confidentiality. The CVSS 4.0 score of 9.3 reflects a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates. Until a fix is available, avoid using versions prior to 1.4.0 for sensitive cryptographic operations or apply additional cryptographic safeguards to mitigate predictable key derivation.