Cache plaintext disclosure via low-entropy key derivation

Insufficient entropy in CyberArk Credential Provider before 12.1 allows local users to read plaintext secrets from encrypted cache files. The cache encrypts each line with AES-CBC, but derives its 256-bit key from only the application type, a predictable provider username, and two hard-coded byte sequences. Root access to the host or equivalent offline access to its files is required; successful decryption exposes cached passwords, metadata, and application properties.