HMAC Exposure Vulnerability in Slack Morphism Client Library

CVE-2026-113799

What is CVE-2026-113799?

The Slack Morphism client library contains a vulnerability where incorrect handling of signature verification could expose the correct HMAC of requests when invalid signatures are processed. Attackers capable of accessing the application's Slack callback endpoint and reading service logs can exploit this flaw. By sending a crafted request and observing the logged output, they can recover the valid HMAC signature and carry out subsequent valid requests without knowing the original signing secret. This can lead to unauthorized access to protected resources. Users should upgrade to version 2.28.0 or later to mitigate this risk.

References