This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-89320 | BDVDB-2026-394813 Detail

Eclipse FoundationEclipse KeyPont - GOSE

Description#

`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.

Impact#

Per CVSS v4.0: confidentiality impact low, integrity impact high, availability impact none. Attack vector: network.

Weaknesses#

  • CWE-354 Improper Validation of Integrity Check Value

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.
  2. Version 2Most recent update recorded in the CVE List.