# CVE-2026-53939: OpenIDC cjose all-zero CEK in AES-CBC-HMAC encryption

Source: https://junglewise.ai/threats/cve-2026-53939-openidc-cjose-all-zero-cek-in-aes-cbc-hmac-encryption  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-53939 · Severity: critical · CVSS 9.1 · Published 2026-09-09

OpenIDC cjose is a cryptographic library used to encrypt sensitive data using industry-standard JOSE (JSON Object Signing and Encryption) protocols. A critical flaw caused the library to encrypt data using a fixed, publicly known all-zero encryption key instead of generating random keys when using certain AES-CBC-HMAC algorithms. This means anyone obtaining an encrypted message can decrypt and forge it, completely compromising the confidentiality and integrity of protected data.

Vendors: [Openidc](https://junglewise.ai/threats/vendors/openidc).

## Quick answers

**Is CVE-2026-53939 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53939 being exploited in the wild.

**How severe is CVE-2026-53939?** Critical severity, with a CVSS score of 9.1, published 9 September 2026.

**Which products and versions are affected?** Openidc Cjose 0.6.1 through 0.6.2.5.

**Is there a fix for CVE-2026-53939?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-53939 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-53939?** Check whether you run Openidc Cjose at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a cryptographic key generation failure in the AES-CBC-HMAC content-encryption code path. The `_cjose_jwe_set_cek_aes_cbc()` function inverted the `random` parameter when allocating the content-encryption key (CEK), causing it to zero-fill the key instead of generating random bytes via `RAND_bytes()`. This affects JWE encryption using AES-CBC-HMAC algorithms (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) combined with any key-management algorithm except `dir`, including RSA-OAEP, RSA1_5, and AES-KW variants. The resulting ciphertexts are encrypted and authenticated under an all-zero key. AES-GCM and `dir`-mode encryption paths were unaffected. The vulnerability was fixed in version 0.6.2.6 by correcting the parameter passed to `_cjose_jwe_malloc()` and is demonstrated by regression tests confirming CEK randomness across encryptions. Data already encrypted with the zero key cannot be secured retroactively without re-encryption.

## Affected products

- OpenIDC cjose 0.6.1 through 0.6.2.5

## Timeline

- 2026-09-09: disclosed

## References

- [https://github.com/OpenIDC/cjose/commit/2a6e5bd969fa20059fb00913fb9f57d77ea6a4d9](https://github.com/OpenIDC/cjose/commit/2a6e5bd969fa20059fb00913fb9f57d77ea6a4d9)
- [https://github.com/OpenIDC/cjose/releases/tag/v0.6.2.6](https://github.com/OpenIDC/cjose/releases/tag/v0.6.2.6)

## Related threats

- [OpenIDC cjose heap buffer overflow in AES Key Wrap decryption](https://junglewise.ai/threats/cve-2026-53938-openidc-cjose-heap-buffer-overflow-in-aes-key-wrap-decryption)