Read the docs
TI-2026-25401 Aliases CVE-2026-32953GHSA-4w7r-3222-8h6v

Tillitis: TKey Client has an Error in Protocol Implementation

Priority LOW 21CWE-303Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Tillitis TKey Client package is a Go package for a TKey client. Versions 1.2.0 and below contain a critical bug in the tkeyclient Go module which causes 1 out of every 256 User Supplied Secrets (USS) to be silently ignored, producing the same Compound Device Identifier (CDI)—and thus the same key material—as if no USS is provided. This happens because a buffer index error overwrites the USS-enabled boolean with the first byte of the USS digest, so any USS whose hash starts with 0x00 is effectively discarded. This issue has been fixed in version 1.3.0. Users unable to upgrade immediately should switch to a USS whose hash does not begin with a zero byte.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00256 17th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed tkeyclient (tillitis): 1.3.0github.com/tillitis/tkeyclient (Go): 1.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tillitistkeyclientbefore 1.3.01.3.0Patch availableCNA
—github.com/tillitis/tkeyclient (Go)before 1.3.01.3.0Patch availableGHSA-4w7r-3222-8h6v
  • tkeyclient Vendortillitis Affected before 1.3.0 Fixed in 1.3.0 Patch available CNA
  • github.com/tillitis/tkeyclient (Go) Vendor— Affected before 1.3.0 Fixed in 1.3.0 Patch available GHSA-4w7r-3222-8h6v

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tillitis:tkey_client:*:*:*:*:*:go:*:*before 1.3.0Vulnerabletillitis
  • cpe:2.3:a:tillitis:tkey_client:*:*:*:*:*:go:*:* Versions before 1.3.0 Vulnerable ·tillitis

Remediation

  • Fix · CNA tkeyclient (tillitis) Fixed in 1.3.0
  • Fix · GHSA-4w7r-3222-8h6v github.com/tillitis/tkeyclient (Go) Fixed in 1.3.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32953
  2. 2026-10-03 Alias added: GHSA-4w7r-3222-8h6v

References

Exploit 1

Patch 1

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences