OpenIDC cjose Library Vulnerability in AES-CBC-HMAC Encryption

CVE-2026-53939

What is CVE-2026-53939?

The OpenIDC cjose library versions 0.6.1 to 0.6.2.5 have a critical vulnerability in JWE encryption using AES-CBC-HMAC algorithms. When encrypting, the library incorrectly generates the content-encryption key (CEK) as all zero bytes instead of random values. This flaw allows attackers to decrypt and manipulate the encrypted payloads, leading to compromised security of the data. The issue is addressed in version 0.6.2.6. Until an upgrade is performed, users should consider alternative encryption methods, such as using AES-GCM or providing a custom key, to mitigate the risk. Existing data encrypted with the flawed CEK should be re-encrypted to ensure security.

References