CVE-2026-89320

`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.

• CWE-354

• https://github.com/eclipse-keypont/gose/security/advisories/GHSA-h6w5-722x-2h3m

Published

Oct 23, 2026

Last Modified

Oct 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-89315`JwtClaims.MarshalJSON` built a Go struct at runtime with `r…6.9
• CVE-2026-89316`LoadPublicKey` resolved an EC key's curve with an unchecked…6.3
• CVE-2026-89317gose parsed the JWS `crit` header into `JwsHeader.Crit` and …6.3
• CVE-2026-89318`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's …6.9
• CVE-2026-89319`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext le…6.3
• CVE-2026-8932libcurl would reuse a previously created connection even whe…7.5
• CVE-2026-89321Publishing limits the compressed size of a VSIX (ovsx.publis…4.3
• CVE-2026-89322Vault and Vault Enterprise did not consistently evaluate ACL…7.2
• CVE-2026-89325An uncontrolled search path element in InsightVM assessment …7.8
• CVE-2026-89327The FluentBoards WordPress plugin before 2.0.15 does not ve…3.8
• CVE-2026-89328The FluentBoards WordPress plugin before 2.0.15 does not pr…3.8
• CVE-2026-89329A flaw was found in `multipathd`. A local attacker with acce…6.2