{"id":"CVE-2026-89320","published":"2026-10-23T09:17:08.610","lastModified":"2026-10-23T19:30:07.567","description":"`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K(\"\")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-354"],"vendors":[],"products":[],"references":[{"url":"https://github.com/eclipse-keypont/gose/security/advisories/GHSA-h6w5-722x-2h3m","tags":[]}],"exploitRefs":[{"url":"https://github.com/eclipse-keypont/gose/security/advisories/GHSA-h6w5-722x-2h3m","tags":[]}],"hasPoc":true,"ai":null}