The critical severity here is earned, but not for the reason most will initially assume. The issue isn't simply that unauthenticated AES-CTR is being used — it's that the code architecture treats authentication failure as a recoverable condition requiring fallback rather than as a terminal security event. This is a fundamental misapplication of crypto design principles. When GCM fails, the correct response is to reject the operation entirely, not to retry with reduced guarantees. The 'failure' is the security mechanism working; circumventing it on error defeats the entire purpose.
Check your dependencies now. If your codebase pulls in any post-quantum hybrid wrapper libraries — particularly those exposing openssl_encrypt with GCM as an option — audit for fallback logic in the crypto path. The specific pattern to search for is any code that attempts an authenticated mode first and silently degrades to CTR or CBC on failure. This is not a compatibility feature; it's an attack surface. If GCM negotiation can be manipulated to fail — through MITM injection, timing manipulation, or optional-mode targeting — an attacker gains unauthenticated access by design.
The EPSS score of 0.0024 despite a 9.8 CVSS is a signal, not an anomaly. Low EPSS with high CVSS typically indicates the vulnerable code lives in developer tooling or dependency chains rather than direct production targets. This means the blast radius extends beyond the wrapper itself: downstream libraries and applications that consume the PQC wrapper inherit the fallback behavior without auditing the crypto layer. Your application doesn't need to directly use pqc.py to be vulnerable — it just needs to transitively depend on something that does.
The post-quantum context makes this worse, not better. Hybrid schemes are being deployed under aggressive timelines with the explicit promise of 'layered security' — quantum-resistant key encapsulation plus classical encryption. If the classical layer silently degrades to unauthenticated CTR on error, that guarantee is illusory. An attacker who cannot touch the quantum-resistant layer can still compromise the classical half without breaking any quantum math. The hybrid wrapper doesn't inherit the security properties of the new primitive — it inherits the implementation debt of the old one.
Prioritize: audit your dependency tree for PQC wrappers, remove any fallback-to-weaker-modes code paths, and treat authentication failure as a terminal condition in cryptographic operations. The remediation isn't just patching this instance — it's establishing that post-quantum migration tooling carries a special obligation: any code path that reduces security guarantees should fail closed, not fall back to compatibility.