{"id":"CVE-2026-89320","kind":"vulnerability","aliases":["CVE-2026-89320"],"related":[],"title":"gose: JWE integrity tag ignored message, so ciphertext is unauthenticated","description":"`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K(\"\")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.","summary":"gose's HmacShaCryptor.Hash never hashed its input (misused hash.Sum), so every AES-CBC-HMAC JWE tag equals HMAC_K(\"\"), constant per key. An attacker who has seen one valid JWE can reuse its tag on any ciphertext, so bit-flipping and padding-oracle attacks become possible. Only the CBC-HMAC direct path is affected; AEAD/GCM is not. Affected: github.com/ThalesGroup/gose v0.9.0 to v0.13.0-rc1. Fixed in commit 97f9348, shipped only as github.com/eclipse-keypont/gose >= v1.0.0-rc1.","severity":"high","cvss":8.8,"epss":0.00174,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/ThalesGroup/gose","fixed":[],"affected":">= 0.9.0, <= 0.13.0-rc1","ecosystem":"go"},{"name":"github.com/eclipse-keypont/gose","fixed":["1.0.0-rc1"],"affected":"none","ecosystem":"go"}],"ecosystems":["go"],"tags":["cbc-hmac","go","gose","jose","jwe","package"],"not_affected_if":["aead-gcm-only","does-not-use-gose","eclipse-keypont-module-path","no-aes-cbc-hmac-jwe"],"how_to_check":"grep go.mod/go.sum for github.com/ThalesGroup/gose (any version v0.9.0 through v0.13.0-rc1 is affected; v0.7.3 to v0.8.7 are not). Then grep the code for NewJweDirectEncryptorBlock / NewJweDirectDecryptorBlock: if you only use the Aead variants you are not exploitable. Command: go list -m all | grep -i gose","fix":"go get -u will NOT fix this. Change the module path: replace github.com/ThalesGroup/gose v0.13.0-rc1 with github.com/eclipse-keypont/gose v1.0.0-rc3 (v1.0.0-rc1 is the first fixed release) and rewrite all import paths. Workaround: switch to the AEAD/GCM path (NewJweDirectEncryptorAead / NewJweDirectDecryptorAeadImpl). Treat tokens made by affected versions as unauthenticated and re-issue/re-encrypt them.","status":"open","published_at":"2026-10-23T09:17:08+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:25+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-10-23T22:31:25Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade gose to a release that includes the fix for CVE-2026-89320; the exact fixed version is unknown from the sources.\nRotate any keys and re-issue tokens that were produced or accepted by the affected version, if they were used for trust decisions.","reach":"network","title":"gose: JWE integrity tag ignored message, so ciphertext is unauthenticated","impact":"high","summary":"The gose Go library's HMAC hasher returned the MAC of an empty message instead of the input, so AES-CBC-HMAC JWE tokens carry a tag that does not depend on the content. An attacker can alter or forge encrypted payloads without the tag catching it.","category":"package","who_cares":["go","jose","jwe"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker forges or modifies encrypted JWE payloads that gose accepts as authentic.","analyst_note":"Find the fixed gose version and the affected version range in the upstream repository advisory or NVD entry.","how_to_check":"Check whether go.mod or go.sum lists github.com/... gose (the gose Go package) and note its version.\nunknown","needs_analyst":true,"not_affected_if":["does-not-use-gose","no-aes-cbc-hmac-jwe"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00053,"input_tokens":2920,"output_tokens":475,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed gose release and affected version range at the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-89320 or the gose repository advisory.","search":"'-2026':12A,15A '-89320':13A,16A '/eclipse-keypont/gose':22A,108B '/thalesgroup/gose':19A,95B '97f9348':102B 'ae':43B,133C 'aead/gcm':89B 'aes-cbc-hmac':42B,132C 'affect':88B,92B 'attack':55B,77B 'authent':145C 'becom':78B 'bit':71B 'bit-flip':70B 'carri':143C 'cbc':24B,44B,83B,134C 'cbc-hmac':23B,82B 'ciphertext':8A,68B,158C 'commit':101B 'constant':51B,149C 'cve':11A,14A 'direct':85B 'empti':126C 'entir':160C 'equal':48B 'everi':41B,131C 'fix':99B 'flip':72B 'github.com':18A,21A,94B,107B 'github.com/eclipse-keypont/gose':20A,106B 'github.com/thalesgroup/gose':17A,93B 'go':26B 'gose':1A,27B,31B,141C 'hash':35B,112C 'hash.sum':39B 'hmac':25B,45B,49B,84B,120C,135C 'hmacshacryptor.hash':33B,110C 'ignor':5A 'independ':153C 'input':37B,114C,117C 'integr':3A,159C 'jose':28B 'jwe':2A,29B,46B,61B,136C 'k':50B,121C 'key':53B,130C,151C 'mac':123C 'messag':6A,127C,156C 'misus':38B 'never':34B,111C 'one':59B 'oracl':76B 'packag':30B 'pad':75B 'padding-oracl':74B 'path':86B 'per':52B,150C 'possibl':79B 'produc':137C 'remov':157C 'return':119C 'reus':63B 'seen':58B 'ship':103B 'tag':4A,47B,65B,146C 'therefor':142C 'unauthent':10A 'v0.13.0-rc1':98B 'v0.9.0':96B 'v1.0.0-rc1':109B 'valid':60B 'verifi':139C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T09:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89320","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89320","severity":null,"published_at":"2026-10-23T09:17:08+00:00","modified_at":"2026-10-23T19:30:07+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-89320:478","url":null,"severity":null,"published_at":"2026-10-23T23:36:34+00:00","modified_at":"2026-10-23T23:36:34+00:00","first_seen_at":"2026-10-23T23:36:34+00:00","fetched_at":"2026-10-23T23:36:34+00:00","note":"Read vendor GHSA-h6w5-722x-2h3m and CVE record. Fix only under new module path eclipse-keypont/gose >= v1.0.0-rc1; ThalesGroup/gose has no patched release. No exploitation seen; reproducer test is in the advisory. Did not search social posts (niche library)."},{"source":"epss","external_id":"CVE-2026-89320","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89320","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":2068,"url":"https://github.com/eclipse-keypont/gose/security/advisories/GHSA-h6w5-722x-2h3m","title":"GHSA-h6w5-722x-2h3m: HmacShaCryptor.Hash never hashes its input (eclipse-keypont/gose)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2070,"url":"https://www.cve.org/CVERecord?id=CVE-2026-89320","title":"CVE Record: CVE-2026-89320","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2068,"url":"https://github.com/eclipse-keypont/gose/security/advisories/GHSA-h6w5-722x-2h3m","title":"GHSA-h6w5-722x-2h3m: HmacShaCryptor.Hash never hashes its input (eclipse-keypont/gose)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}