CVE-2026-89320

HighCVSS 8.8

Published: 23/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 23/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

7th percentile - higher than 7% of all known CVEs

Summary

HmacShaCryptor.Hash never hashed its input — for any input it returned HMAC_K(""), the MAC of the empty message under the key. As a result, every AES-CBC-HMAC JWE produced or verified by gose carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.

Risk Assessment

The lack of ciphertext integrity allows an attacker to modify JWE contents without detection, potentially leading to injection or substitution of data protected by gose. The risk affects all uses of the gose library for AES-CBC-HMAC JWE.

Recommendation

Update the gose library to a version containing the HmacShaCryptor.Hash fix and revoke/refresh JWE tokens generated by the vulnerable version.

Other vulnerabilities in gose

CVE-2026-89317Medium
gose parsed the JWS crit header into JwsHeader.Crit and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand; gose implements no header extensions, so every token carrying a non-empty crit should have been rejected — and none were.

Original NVD description (English source)

`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS