gose: Improper integrity check in AES-CBC-HMAC JWE processing
Summary
The Go library gose, which implements JOSE, computes the HMAC for AES-CBC-HMAC JWEs incorrectly. HmacShaCryptor.Hash ignores its input and always returns the MAC of the empty message under the key, so the authentication tag is constant per key and independent of the message. An attacker who has seen one valid JWE can replace the ciphertext and the integrity check still passes, without knowing the key, which enables bit-flipping and padding-oracle style attacks. Only applications that use the AES-CBC-HMAC direct encryption path are affected; the AEAD/GCM path is not.
Affected
- github.com/ThalesGroup/gose v0.9.0 to v0.13.0-rc1
- Per the CNA record: github.com/eclipse-keypont/gose before v1.0.0-rc1 (the vendor advisory states that no vulnerable release exists under this module path)
Fixed in
- Fixed in github.com/eclipse-keypont/gose v1.0.0-rc1 and later (fix commit 97f9348)
- No fixed release exists on github.com/ThalesGroup/gose; the module path must be changed
Workaround
- None within the affected releases.
- Avoid NewJweDirectEncryptorBlock and NewJweDirectDecryptorBlock and use NewJweDirectEncryptorAead and NewJweDirectDecryptorAeadImpl (AEAD/GCM) instead.
Exploitation
- No known exploitation in the wild at the time of research.
- No public proof of concept known at the time of research.
- EPSS 0.00174 at the time of research; CISA KEV status not verified.
Our recommendation
- Check whether your Go software uses gose, especially AES-CBC-HMAC JWEs (NewJweDirectEncryptorBlock / NewJweDirectDecryptorBlock).
- Migrate to github.com/eclipse-keypont/gose v1.0.0-rc1 or later and update the import paths; go get -u alone does not fix this.
- Treat JWEs created or verified by affected versions as unauthenticated and re-encrypt the data under the patched version.
- Until patched, do not rely on JWE integrity from affected components and add independent integrity checks where possible.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-h6w5-722x-2h3m github.com
- gose pull request 28 (v1 migration, HMAC fix) github.com
- Go package documentation: github.com/eclipse-keypont/gose pkg.go.dev
- Go package documentation: github.com/ThalesGroup/gose pkg.go.dev
- NVD mirror: CVE-2026-89320 (Vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:51.
Original description (NVD)
`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.