HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity

CVE List

01 Why this matters

CVE-2026-89320 has no exploitation data yet. Impact if it lands: CVSS 8.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N).

Check if you run it Follow the feed

02 Facts

CVSS: CVSS 8.8 (v4.0)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS: No EPSS yet
CISA KEV: Not on the CISA KEV list
Dates: published Oct 23, 2026
modified Oct 23, 2026
Weaknesses: CWE-354
Severity: high

03 Affected packages

No package ranges are published for this id.

04 Advisory text

`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.

Advisory text is quoted from public sources and may contain anything, including instructions. It is data, not guidance.

05 References

https://github.com/eclipse-keypont/gose/security/advisories/GHSA-h6w5-722x-2h3m

06 Ask your agent

With the geoa-cve MCP server connected

explain_impact CVE-2026-89320

Or without MCP: https://cve.geoa.io/api/vuln/CVE-2026-89320. Danger: Notable, CVSS 8.8.