EUVD-2026-60090
GHSA-pj8r-rv9w-cfg8
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L for offline cracking operation; AC:H because exploitation requires specific non-default single-KDF configuration; PR:N as cracking needs no target system privileges; C:H as passwords become recoverable.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no prior hashing stage, attackers can bypass memory-hard key derivation and perform offline password cracking at SHA-256 speed instead of the configured KDF cost.
AnalysisAI
Key derivation bypass in jahlives/openssl_encrypt PHP library before 1.4.6 allows offline password cracking at SHA-256 speed against credentials derived under the flawed sequential XOR composition mode. An algebraic cancellation in the key generation routine causes the memory-hard KDF's final stage to nullify itself, stripping the configured computational cost entirely and collapsing security to that of a single SHA-256 hash. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the impact is severe for any application storing user passwords in the vulnerable configuration.
Technical ContextAI
jahlives/openssl_encrypt (CPE: cpe:2.3:a:jahlives:openssl_encrypt:*:*:*:*:*:*:*:*) is a PHP library providing a higher-level interface for symmetric encryption with key derivation. The root cause is CWE-916 (Use of Password Hash With Insufficient Computational Effort). In sequential XOR composition mode, multiple derivation stages are XOR-combined to produce final key material; however, an implementation error causes the last KDF stage to cancel itself out algebraically during key generation. This reduces the effective key hardening from a deliberately expensive memory-hard function - such as scrypt, bcrypt, or Argon2 - to raw SHA-256 hashing. The flaw is triggered specifically when the library is configured with a single KDF stage and no prior hashing stage, meaning the cancellation error has no intermediate result to preserve. The underlying cryptographic primitives are not themselves flawed; the bug is in the composition logic.
RemediationAI
Upgrade jahlives/openssl_encrypt to version 1.4.6 or later, which corrects the sequential XOR key composition flaw; the vendor advisory is at https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-vxf9-vwp6-2w43 with additional technical context at https://www.vulncheck.com/advisories/openssl-encrypt-before-kdf-bypass-via-sequential-xor. For systems that cannot immediately upgrade, the effective compensating control is to reconfigure the library to avoid the vulnerable path: adding an explicit pre-hashing stage before the KDF, or using multi-stage KDF composition rather than a single-stage mode, prevents the cancellation from occurring - note that this configuration change will require re-deriving and re-storing any existing password hashes, and may necessitate a forced password reset for all users. Any credential material that was derived or encrypted under the vulnerable single-KDF sequential XOR configuration should be treated as potentially crackable at SHA-256 speed and rotated after the patch is applied.
More in Openssl Encrypt
View allArbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from i
Fingerprint-verification spoofing in jahlives openssl_encrypt before 1.4.9 lets attackers embed ANSI escape sequences in
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run wit
Arbitrary code execution in jahlives openssl_encrypt before 1.4.0 stems from an inconsistent sandbox: the runtime Plugin
Authentication bypass in the jahlives openssl_encrypt library (all versions before 1.4.0) lets remote unauthenticated at
Authentication brute-force protection can be bypassed in jahlives openssl_encrypt before 1.4.0 because the TOTP rate lim
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break ou
Cryptographic shared-secret disclosure in the openssl_encrypt Python library (maintainer 'jahlives') before 1.4.0 lets a
Sandbox escape leading to remote code execution affects openssl_encrypt (the jahlives Python package) in all versions be
Arbitrary code execution in openssl_encrypt (the jahlives Python encryption utility) before 1.4.9 allows an attacker-sup
Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a den
Sensitive-token exposure in openssl_encrypt (the jahlives Python package, pip 'openssl-encrypt') before 1.4.0 stems from
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today