{"schema":"threatline.record/2","record":{"id":"CVE-2026-89320","aliases":["GHSA-h6w5-722x-2h3m"],"summary":"HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K(\"\") for all inputs, voiding CBC-HMAC JWE integrity","details":"`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K(\"\")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.","categories":["Unclassified"],"product":"Eclipse KeyPont - GOSE","vendor":"Eclipse Foundation","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-89320","source_modified_at":"2026-10-23T08:56:20.140Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Eclipse KeyPont - GOSE","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"0.13.0-rc1","status":"affected","version":"0.9.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-89320","source_modified_at":"2026-10-23T08:56:20.140Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Eclipse KeyPont - GOSE","vendor":"Eclipse Foundation","versions":[{"lessThan":"1.0.0-rc1","status":"affected","version":"0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"GitHub Advisory Database","source_url":"https://github.com/eclipse-keypont/gose/security/advisories/GHSA-h6w5-722x-2h3m","source_modified_at":"2026-10-23T08:55:40Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"ecosystem":"go","name":"github.com/ThalesGroup/gose"},"range":">= 0.9.0, <= 0.13.0-rc1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/eclipse-keypont/gose/security/advisories/GHSA-h6w5-722x-2h3m","source_modified_at":"2026-10-23T08:55:40Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"ecosystem":"go","name":"github.com/eclipse-keypont/gose"},"range":"< 1.0.0-rc1"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-89320","source_modified_at":"2026-10-23T08:56:20.140Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Eclipse KeyPont - GOSE","ecosystem":null},"version":"1.0.0-rc1","basis":"first unaffected version stated in the CVE record"}],"cvss":8.8,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00174,"percentile":0.06549,"score_date":"2026-10-23"},"published_at":"2026-10-23T08:56:20.140Z","modified_at":"2026-10-23T08:56:20.140Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-89320","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T08:56:20.140Z"},{"source":"GitHub Advisory Database","url":"https://github.com/eclipse-keypont/gose/security/advisories/GHSA-h6w5-722x-2h3m","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-23T08:55:40Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89320","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/eclipse-keypont/gose/security/advisories/GHSA-h6w5-722x-2h3m"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-23T08:56:20.140Z","content_hash":"a61f359f8992745ce7ad3b6e7cd732df5fb22dfcf8eaa022a775d7c61c0822fc"}}