GHSA-gxhx-2686-5h9g

Suggest an improvement
Source
https://github.com/advisories/GHSA-gxhx-2686-5h9g
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-gxhx-2686-5h9g/GHSA-gxhx-2686-5h9g.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-gxhx-2686-5h9g
Aliases
Downstream
Related
Published
2026-05-14T20:52:55Z
Modified
2026-07-13T05:15:09.410908561Z
Severity
  • 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator
Summary
slack-go `SecretsVerifier` accepts empty signing secret without precondition
Details

SecretsVerifier in slack-go/slack before v0.23.1 accepts an empty signing secret without error. If an application is misconfigured (e.g., an unset or empty SLACK_SIGNING_SECRET), NewSecretsVerifier builds an HMAC-SHA256 keyed with an empty string, allowing an unauthenticated attacker to forge a valid X-Slack-Signature and bypass Slack request authentication. Fixed in v0.23.1, which rejects empty secrets with ErrInvalidConfiguration. This is patched in version 0.23.1.

Database specific 
{
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-1391",
        "CWE-287",
        "CWE-326"
    ],
    "nvd_published_at": null,
    "github_reviewed_at": "2026-05-14T20:52:55Z",
    "github_reviewed": true
}
References

Affected packages

Go / github.com/slack-go/slack

Package

Name
github.com/slack-go/slack
View open source insights on deps.dev
Purl
pkg:golang/github.com/slack-go/slack

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.23.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-gxhx-2686-5h9g/GHSA-gxhx-2686-5h9g.json"