OpenIDC's cjose library versions 0.6.1 through 0.6.2.5 contain a cryptographic vulnerability where the content-encryption key (CEK) for AES-CBC-HMAC algorithms (`A128CBC-HS256`, `A192CBC-HS384`, `A256CBC-HS512`) is not randomly generated but set to all zero bytes. This results in JWE tokens encrypted and authenticated under a fixed, publicly known key, allowing plaintext recovery and forgery by anyone possessing the JWE. The vulnerability is resolved in version 0.6.2.6 by generating the CEK securely with `RAND_bytes`. Until upgrading, mitigations include using AES-GCM encryption modes, using direct key management with caller-supplied CEK, or avoiding the vulnerable algorithm pair. Existing data encrypted with the zero key is compromised and requires re-encryption and secret rotation.

The vulnerability allows attackers who obtain JWE tokens encrypted with the affected cjose versions and AES-CBC-HMAC algorithms to decrypt the content and forge or modify it. This compromises confidentiality and integrity of the encrypted data. There is no impact on availability. The CVSS score is 9.1 (critical), reflecting network attack vector, low complexity, no privileges or user interaction required, and high confidentiality and integrity impact.

A fix is available in cjose version 0.6.2.6, which properly generates the content-encryption key using a secure random function. For new ciphertexts, until upgrading, use AES-GCM encryption modes (`A128GCM`, `A192GCM`, `A256GCM`), use `alg=dir` with a caller-supplied CEK, or avoid using cjose for JWE encryption with the affected AES-CBC-HMAC algorithm pair. Data already encrypted with the zero key remains compromised and must be re-encrypted with rotated secrets. Since this is a library, users should upgrade to the fixed version promptly.