CVE-2026-89320: gose HmacShaCryptor.Hash cryptographic bypass in AES-CBC-HMAC JWE

CVE-2026-89320 · Severity: info · Published 2026-10-23

The gose library (a cryptographic library for JSON Web Encryption) contains a critical flaw in its HMAC implementation that breaks authentication integrity for AES-CBC-HMAC encrypted messages. The Hash function returns the same HMAC tag regardless of message content, allowing attackers to forge or modify encrypted data without knowing the encryption key. This vulnerability affects all JWE messages encrypted with AES-CBC-HMAC mode produced or verified by affected versions.

Technologies: Thalesgroup Gose. Vendors: Thalesgroup.

Quick answers

Is CVE-2026-89320 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-89320 being exploited in the wild.
How severe is CVE-2026-89320?
Informational severity, published 23 October 2026.
Which products and versions are affected?
Eclipse Keypoint Gose < 1.0.0-rc1; Thalesgroup Gose >= 0.9.0, <= 0.13.0-rc1.
Is there a fix for CVE-2026-89320?
Yes: fixed in eclipse-keypont/gose >= 1.0.0-rc1. Until then: Users unable to migrate immediately should avoid NewJweDirectEncryptorBlock and NewJweDirectDecryptorBlock; use the AEAD/GCM path (NewJweDirectEncryptorAead / NewJweDirectDecryptorAeadImpl) instead. Any data encrypted by affected releases must be treated as unauthenticated and should be re-encrypted after upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89320 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-89320?
Check whether you run Eclipse Keypoint Gose or Thalesgroup Gose at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: eclipse-keypont/gose >= 1.0.0-rc1

Users unable to migrate immediately should avoid NewJweDirectEncryptorBlock and NewJweDirectDecryptorBlock; use the AEAD/GCM path (NewJweDirectEncryptorAead / NewJweDirectDecryptorAeadImpl) instead. Any data encrypted by affected releases must be treated as unauthenticated and should be re-encrypted after upgrading.

Technical details

HmacShaCryptor.Hash() never processes its input; instead, it returns a constant value (HMAC of the empty message) for all inputs due to misuse of hash.Hash.Sum(). Since the authentication tag is independent of ciphertext, an attacker can observe one valid JWE and reuse its HMAC tag on arbitrary ciphertext, bypassing integrity verification entirely. The vulnerability affects only AES-CBC-HMAC JWE modes; AEAD/GCM modes are unaffected as they do not use HmacShaCryptor.

Affected products

  • ThalesGroup gose >= 0.9.0, <= 0.13.0-rc1
  • Eclipse Keypoint gose < 1.0.0-rc1

Timeline

  • 2024-08-02: other: Vulnerability introduced in commit b7b140e with AES-CBC-then-HMAC support
  • 2026-08-31: disclosed: GHSA-h6w5-722x-2h3m published
  • 2026-06-16: patched: Fix landed in commit 97f9348
  • 2026-07-27: other: Module path migrated from github.com/ThalesGroup/gose to github.com/eclipse-keypont/gose
  • 2026-10-23: advisory: CVE-2026-89320 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.