GHSA-gxhx-2686-5h9g

Source

https://github.com/advisories/GHSA-gxhx-2686-5h9g

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-gxhx-2686-5h9g/GHSA-gxhx-2686-5h9g.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gxhx-2686-5h9g

Aliases

GO-2026-5410

Downstream

CGA (81)

MINI (30)

Published

2026-05-14T20:52:55Z

Modified

2026-09-10T03:50:47Z

Severity

4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

slack-go `SecretsVerifier` accepts empty signing secret without precondition

Details

SecretsVerifier in slack-go/slack before v0.23.1 accepts an empty signing secret without error. If an application is misconfigured (e.g., an unset or empty SLACK_SIGNING_SECRET), NewSecretsVerifier builds an HMAC-SHA256 keyed with an empty string, allowing an unauthenticated attacker to forge a valid X-Slack-Signature and bypass Slack request authentication. Fixed in v0.23.1, which rejects empty secrets with ErrInvalidConfiguration. This is patched in version 0.23.1.

Database specific

{
    "cwe_ids":  [
        "CWE-1391",
        "CWE-287",
        "CWE-326"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-14T20:52:55Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

Go / github.com/slack-go/slack

Package

Name: github.com/slack-go/slack; View open source insights on deps.dev
Purl: pkg:golang/github.com/slack-go/slack

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.23.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-gxhx-2686-5h9g/GHSA-gxhx-2686-5h9g.json"