The vulnerability in jahlives openssl_encrypt prior to version 1.4.0 involves inadequate encryption strength due to the use of HKDF without a salt and with a static info parameter in key normalization functions. This design flaw reduces the entropy extracted during key derivation and results in deterministic outputs for identical inputs. Consequently, attackers can predict derived keys, undermining cryptographic security and facilitating multi-target attacks by exploiting this predictability.

The impact of this vulnerability is a significant reduction in cryptographic strength, enabling attackers to predict encryption keys derived from identical inputs. This compromises the confidentiality of encrypted data and increases the risk of successful multi-target attacks. The CVSS 4.0 score of 9.3 reflects the critical severity and the potential for widespread impact if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users should monitor the vendor's communications for updates and consider avoiding use of affected versions (<1.4.0) until a fix is available.