Menu

Post image 1
Post image 2
1 / 2
0

GHSA-GXHX-2686-5H9G: GHSA-gxhx-2686-5h9g: Signature Verification Bypass in slack-go via Empty SecretsVerifier

DEV Community·CVE Reports·18 days ago
#A2bC4KJw
Reading 0:00
15s threshold

GHSA-gxhx-2686-5h9g: Signature Verification Bypass in slack-go via Empty SecretsVerifier Vulnerability ID: GHSA-GXHX-2686-5H9G CVSS Score: 7.7 Published: 2026-05-14 The slack-go library prior to version 0.23.1 contains a cryptographic signature verification vulnerability. The SecretsVerifier component fails to validate whether the provided Slack signing secret is empty. Applications initializing this verifier with an empty string—such as from a missing environment variable—allow attackers to bypass request authentication by forging signatures with an empty HMAC key. TL;DR slack-go < 0.23.1 permits empty signing secrets, enabling attackers to bypass Slack request verification by generating valid HMAC signatures using an empty key if the application environment is misconfigured.…

Continue reading — create a free account

Join HashtagPLUS to read full articles, follow hashtags, vote, and join the conversation.

Read More