Read the docs
TI-2026-38908 Aliases CVE-2026-53939

OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption

Priority HIGH 80CWE-321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-321.

Summary

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm (`A128CBC-HS256`, `A192CBC-HS384`, or `A256CBC-HS512`) together with any key-management algorithm that generates a fresh content-encryption key (CEK), the CEK is all zero bytes instead of being randomly generated. The resulting JWE is therefore encrypted and authenticated under a fixed, publicly known key, so anyone who obtains the JWE can recover the plaintext and forge or modify the content. This is fixed in version 0.6.2.6 by `_cjose_jwe_set_cek_aes_cbc()` generating the CEK from `RAND_bytes`. A regression test asserts that the `encrypted_key` differs across two encryptions for each AES-CBC-HMAC variant. Until upgrading, for data encrypted with cjose, three options are available. Use an AES-GCM `enc` (`A128GCM` / `A192GCM` / `A256GCM`) instead of an AES-CBC-HMAC `enc`, use `alg=dir` with a caller-supplied CEK, or avoid using cjose for JWE encryption with the affected algorithm pair. These are mitigations for new ciphertexts only; data already encrypted under the zero key remains compromised and should be re-encrypted (and any secrets it contained rotated).

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00245 15th percentileScored 2026-11-07
Fix Fixed cjose (OpenIDC): 0.6.2.6Red Hat: 10 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenIDCcjose0.6.1 to before 0.6.2.60.6.2.6Patch availableCNA
  • cjose VendorOpenIDC Affected 0.6.1 to before 0.6.2.6 Fixed in 0.6.2.6 Patch available CNA

Remediation

  • Fix · CNA cjose (OpenIDC) Fixed in 0.6.2.6

Red Hat 10 advisories

  • RHSA-2026:92145 Released 2026-10-29 · Red Hat rating Critical
    cjose security update
    • Red Hat Enterprise Linux AppStream (v. 9) cjose-0.6.1-17.el9_8.2
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) cjose-devel-0.6.1-17.el9_8.2
  • RHSA-2026:92157 Released 2026-10-29 · Red Hat rating Critical
    mod_auth_openidc:2.3 security update
    • Red Hat Enterprise Linux AppStream (v. 8) cjose-0.6.1-6.module+el8.10.0+25174+9c399f63.aarch64::mod_auth_openidc:2.3, cjose-0.6.1-6.module+el8.10.0+25174+9c399f63.ppc64le::mod_auth_openidc:2.3, cjose-0.6.1-6.module+el8.10.0+25174+9c399f63.s390x::mod_auth_openidc:2.3 +11
  • RHSA-2026:92159 Released 2026-10-29 · Red Hat rating Critical
    mod_auth_openidc:2.3 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) cjose-0.6.1-3.module+el8.6.0+25217+11ffe348.2.src::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.6.0+25217+11ffe348.2.x86_64::mod_auth_openidc:2.3, cjose-devel-0.6.1-3.module+el8.6.0+25217+11ffe348.2.x86_64::mod_auth_openidc:2.3 +2
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) cjose-0.6.1-3.module+el8.6.0+25217+11ffe348.2.src::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.6.0+25217+11ffe348.2.x86_64::mod_auth_openidc:2.3, cjose-devel-0.6.1-3.module+el8.6.0+25217+11ffe348.2.x86_64::mod_auth_openidc:2.3 +2
Show 7 more Red Hat advisories
  • RHSA-2026:92158 Released 2026-10-29 · Red Hat rating Critical
    mod_auth_openidc:2.3 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) cjose-0.6.1-3.module+el8.8.0+25209+e122577f.2.ppc64le::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.8.0+25209+e122577f.2.src::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.8.0+25209+e122577f.2.x86_64::mod_auth_openidc:2.3 +5
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) cjose-0.6.1-3.module+el8.8.0+25209+e122577f.2.src::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.8.0+25209+e122577f.2.x86_64::mod_auth_openidc:2.3, cjose-devel-0.6.1-3.module+el8.8.0+25209+e122577f.2.x86_64::mod_auth_openidc:2.3 +2
  • RHSA-2026:92154 Released 2026-10-29 · Red Hat rating Critical
    cjose security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) cjose-devel-0.6.1-17.el9_6.2
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) cjose-0.6.1-17.el9_6.2
  • RHSA-2026:92160 Released 2026-10-29 · Red Hat rating Critical
    mod_auth_openidc:2.3 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) cjose-0.6.1-3.module+el8.4.0+25223+40c6a3da.2.src::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.4.0+25223+40c6a3da.2.x86_64::mod_auth_openidc:2.3, cjose-devel-0.6.1-3.module+el8.4.0+25223+40c6a3da.2.x86_64::mod_auth_openidc:2.3 +2
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) cjose-0.6.1-3.module+el8.4.0+25223+40c6a3da.2.src::mod_auth_openidc:2.3, cjose-0.6.1-3.module+el8.4.0+25223+40c6a3da.2.x86_64::mod_auth_openidc:2.3, cjose-devel-0.6.1-3.module+el8.4.0+25223+40c6a3da.2.x86_64::mod_auth_openidc:2.3 +2
  • RHSA-2026:92155 Released 2026-10-29 · Red Hat rating Critical
    cjose security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) cjose-0.6.1-16.el9_4.2
  • RHSA-2026:92156 Released 2026-10-29 · Red Hat rating Critical
    cjose security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) cjose-0.6.1-13.el9_2.2
  • RHSA-2026:83224 Released 2026-10-15 · Red Hat rating Critical
    cjose security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) cjose-0.6.2.2-7.el10_0.2
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) cjose-devel-0.6.2.2-7.el10_0.2
  • RHSA-2026:80605 Released 2026-10-12 · Red Hat rating Critical
    cjose security update
    • Red Hat Enterprise Linux AppStream (v. 10) cjose-0.6.2.2-7.el10_2.2
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) cjose-devel-0.6.2.2-7.el10_2.2

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:92154
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:80605
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:92157
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:92145
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:92160
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:92159
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:92158
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:92156
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:92155
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:83224
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:92154
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:92160
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:92159
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:92158
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:80605
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:92145
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:83224

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53939
  2. 2026-10-07 Affected versions changed · Red Hat
  3. 2026-10-07 CVSS score added · Red Hat
  4. 2026-10-12 Fix available: RHSA-2026:80605 · Red Hat
  5. 2026-10-12 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · Red Hat
  6. 2026-10-16 Fix available: RHSA-2026:83224 · Red Hat
  7. 2026-10-16 Fix available: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) · Red Hat
  8. 2026-10-21 Affected versions changed · Red Hat
  9. 2026-10-30 Fix available: RHSA-2026:92154 · Red Hat
  10. 2026-10-30 Fix available: RHSA-2026:92155 · Red Hat
  11. 2026-10-30 Fix available: RHSA-2026:92156 · Red Hat
  12. 2026-10-30 Fix available: RHSA-2026:92145 · Red Hat
  13. 2026-10-30 Fix available: RHSA-2026:92157 · Red Hat
  14. 2026-10-30 Fix available: RHSA-2026:92158 · Red Hat
  15. 2026-10-30 Fix available: RHSA-2026:92159 · Red Hat
  16. 2026-10-30 Fix available: RHSA-2026:92160 · Red Hat
  17. 2026-10-30 Fix available: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux AppStream (v. 9) +10 · Red Hat

References

Other 3

  • TI-2024-16331 Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc CVSS 3.1HIGH 7.5
  • TI-2023-19073 Incorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjose CVSS 3.1HIGH 8.6
  • TI-2017-04220 The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc)… CVSS 3.0HIGH 8.6
  • TI-2017-03971 The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc)… CVSS 3.0HIGH 8.6
  • TI-2025-22673 mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data CVSS 4.0HIGH 8.2
  • TI-2023-13144 mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is supplied CVSS 3.1HIGH 7.5
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences