{"id":"GHSA-gxhx-2686-5h9g","aliases":["GO-2026-5410"],"status":"published","title":"slack-go `SecretsVerifier` accepts empty signing secret without precondition","description":"`SecretsVerifier` in slack-go/slack before v0.23.1 accepts an empty signing secret without error. If an application is misconfigured (e.g., an unset or empty `SLACK_SIGNING_SECRET`), `NewSecretsVerifier` builds an HMAC-SHA256 keyed with an empty string, allowing an unauthenticated attacker to forge a valid `X-Slack-Signature` and bypass Slack request authentication. Fixed in v0.23.1, which rejects empty secrets with `ErrInvalidConfiguration`. This is patched in version 0.23.1.","severity":{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1391","CWE-287","CWE-326"],"published":"2026-05-14T20:52:55Z","modified":"2026-09-10T03:50:47Z","fixes":[{"ecosystem":"Go","package":"github.com/slack-go/slack","fixed_in":["0.23.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/slack-go/slack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/slack-go/slack","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.23.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/slack-go/slack","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.23.1"}]}]}],"references":[{"url":"https://github.com/slack-go/slack/security/advisories/GHSA-gxhx-2686-5h9g","tags":["web","advisory"]},{"url":"https://github.com/slack-go/slack/releases/tag/v0.23.1","tags":["web"]},{"url":"https://github.com/slack-go/slack/commit/34ad5c052e446f58505ae8d81a2a72821de107cc","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-gxhx-2686-5h9g"},{"url":"https://github.com/slack-go/slack","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-gxhx-2686-5h9g","title":"slack-go `SecretsVerifier` accepts empty signing secret without precondition","description":"`SecretsVerifier` in slack-go/slack before v0.23.1 accepts an empty signing secret without error. If an application is misconfigured (e.g., an unset or empty `SLACK_SIGNING_SECRET`), `NewSecretsVerifier` builds an HMAC-SHA256 keyed with an empty string, allowing an unauthenticated attacker to forge a valid `X-Slack-Signature` and bypass Slack request authentication. Fixed in v0.23.1, which rejects empty secrets with `ErrInvalidConfiguration`. This is patched in version 0.23.1.","status":"published","published":"2026-05-14T20:52:55Z","modified":"2026-06-29T15:38:03Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-287","CWE-326","CWE-1391"],"updated_at":"2026-11-02T14:40:34.713036Z"}],"osv":[{"id":"GHSA-gxhx-2686-5h9g","title":"slack-go `SecretsVerifier` accepts empty signing secret without precondition","description":"`SecretsVerifier` in slack-go/slack before v0.23.1 accepts an empty signing secret without error. If an application is misconfigured (e.g., an unset or empty `SLACK_SIGNING_SECRET`), `NewSecretsVerifier` builds an HMAC-SHA256 keyed with an empty string, allowing an unauthenticated attacker to forge a valid `X-Slack-Signature` and bypass Slack request authentication. Fixed in v0.23.1, which rejects empty secrets with `ErrInvalidConfiguration`. This is patched in version 0.23.1.","status":"published","published":"2026-05-14T20:52:55Z","modified":"2026-09-10T03:50:47.019550374Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-1391","CWE-287","CWE-326"],"updated_at":"2026-11-02T15:46:48.546324Z"},{"id":"GO-2026-5410","title":"SecretsVerifier accepts empty signing secret without precondition in github.com/slack-go/slack","description":"SecretsVerifier accepts empty signing secret without precondition in github.com/slack-go/slack","status":"published","published":"2026-07-07T16:52:19Z","modified":"2026-07-07T20:30:13.59659284Z","updated_at":"2026-11-02T15:47:02.556545Z"}]}}