Authentication Flaw in gose by Eclipse Keypont
CVE-2026-89320

8.8HIGH

Key Information:

Vendor

Eclipse Foundation

Status
Eclipse Keypont - Gose
Vendor
CVE Published:
23 October 2026

What is CVE-2026-89320?

The vulnerability in gose is due to a failure in the HmacShaCryptor.Hash function, which does not correctly hash its input. This leads to the production of HMAC values that are constant for any given key, rendering the authentication tags independent of the actual message. Consequently, every AES-CBC-HMAC JSON Web Encryption (JWE) produced or verified by gose lacks proper ciphertext integrity, opening the door for potential exploitation and undermining the security of the encrypted data.

Affected Version(s)

Eclipse KeyPont - GOSE 0.9.0 <= 0.13.0-rc1

Eclipse KeyPont - GOSE 0 < 1.0.0-rc1

References

https://github.com/eclipse-keypont/gose/security/advisori...

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eclipse Foundation Security Team
.