slack-go `SecretsVerifier` accepts empty signing secret without precondition
Priority LOW 38CWE-1391Published · Updated
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Security bypass, Information disclosure
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-287 and CWE-326.
Summary
`SecretsVerifier` in slack-go/slack before v0.23.1 accepts an empty signing secret without error. If an application is misconfigured (e.g., an unset or empty `SLACK_SIGNING_SECRET`), `NewSecretsVerifier` builds an HMAC-SHA256 keyed with an empty string, allowing an unauthenticated attacker to forge a valid `X-Slack-Signature` and bypass Slack request authentication. Fixed in v0.23.1, which rejects empty secrets with `ErrInvalidConfiguration`. This is patched in version 0.23.1.
Why it matters now
Fix Fixed github.com/slack-go/slack (Go): 0.23.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | github.com/slack-go/slack (Go) | before 0.23.1 | 0.23.1 | Patch available | GHSA-gxhx-2686-5h9g |
- github.com/slack-go/slack (Go) Vendor— Affected before 0.23.1 Fixed in 0.23.1 Patch available GHSA-gxhx-2686-5h9g
Remediation
- Fix · GHSA-gxhx-2686-5h9g github.com/slack-go/slack (Go) Fixed in 0.23.1 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-gxhx-2686-5h9g
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences