CVE-2026-89320: HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity

Published Oct 23, 2026

Updated

HmacShaCryptor.Hash never hashed its input. For any input it returned HMACK("") — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.

Affected Software

1 affected component

gose

Frequently Asked Questions

What deployments are exposed?

Deployments using gose to produce or verify AES-CBC-HMAC JWE messages are exposed. The affected integrity tag is constant for a given key and does not authenticate the ciphertext or other input.

What does an attacker need to exploit this?

An attacker needs the ability to modify an AES-CBC-HMAC JWE ciphertext or other authenticated message content handled by the affected implementation. The flaw removes ciphertext integrity because verification uses a tag independent of the message.

How can I tell whether messages are affected?

For a given key, affected AES-CBC-HMAC JWE operations produce or accept the same authentication tag regardless of the input message. Systems using gose for these JWE modes should treat messages produced or verified by the vulnerable behavior as lacking integrity protection.

CVE-2026-89320: HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity

Affected Software

Frequently Asked Questions

What deployments are exposed?

What does an attacker need to exploit this?

How can I tell whether messages are affected?

Company

Resources

Contact

Frequently Asked Questions

What deployments are exposed?

What does an attacker need to exploit this?

How can I tell whether messages are affected?