Same Key, Different Trust

A symmetric crypto helper is called by two endpoints in the same application with the same key argument. One endpoint encrypts caller-supplied plaintext and returns the ciphertext as part of its normal response. The other endpoint verifies authorization by decrypting an inbound ciphertext under the same key. The encrypting endpoint becomes a free signing oracle for the verifying endpoint; possession of any output from the first reduces to authorization on the second. The helper's safe default would have salted the key with per-session entropy that isolates the two contexts; both call sites override the default to pass a bare server-wide secret.