slack-go slack authentication bypass in SecretsVerifier

Executive brief

A vulnerability in the slack-go library, used by developers to integrate Go applications with Slack, could allow unauthorized users to bypass security checks. If an application is misconfigured with an empty security secret, the library fails to reject it, allowing attackers to forge valid digital signatures. This could lead to unauthorized commands or data being processed as if they came from a trusted Slack source.

Technical details

The `SecretsVerifier` in slack-go/slack before version 0.23.1 lacks a precondition check for the signing secret's length. When an application is misconfigured with an empty or unset `SLACK_SIGNING_SECRET`, `NewSecretsVerifier` initializes an HMAC-SHA256 engine using an empty string as the key. An unauthenticated remote attacker can exploit this by generating a valid `X-Slack-Signature` using an empty key, effectively bypassing the authentication mechanism intended to verify Slack requests. The vulnerability is addressed in version 0.23.1, which now returns `ErrInvalidConfiguration` if an empty secret is provided.

Affected products

• slack-go slack-go/slack < 0.23.1

Timeline

• 2026-05-10: patched: Version 0.23.1 released
• 2026-05-14: advisory: GitHub Advisory published

References

• https://api.github.com/users/SnailSploit
• https://github.com/SnailSploit
• https://api.github.com/users/SnailSploit/gists%7B/gist_id%7D
• https://api.github.com/users/SnailSploit/repos
• https://avatars.githubusercontent.com/u/95986478?v=4
• https://api.github.com/users/SnailSploit/events%7B/privacy%7D