CVE-2026-89320: CWE-354 Improper Validation of Integrity Check Value in Eclipse Foundation Eclipse KeyPont - GOSE
Description
CVE-2026-89320 is a high-severity vulnerability in Eclipse Foundation's Eclipse KeyPont - GOSE where the HmacShaCryptor.Hash function fails to hash its input and always returns the MAC of an empty message under the key. This flaw causes the authentication tag in AES-CBC-HMAC JSON Web Encryption (JWE) to be constant per key and independent of the message, effectively removing ciphertext integrity.
CVSS v4.0
Score 8.8high
Affected software
Eclipse Foundation
Eclipse KeyPont - GOSE
Eclipse Foundation
Eclipse KeyPont - GOSE
pkg:github/github.com/ThalesGroup/gosepkg:github/github.com/eclipse-keypont/goseRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises because the HmacShaCryptor.Hash method never processes its input data and instead returns a fixed MAC value computed over an empty message with the given key. Consequently, any AES-CBC-HMAC JWE produced or verified by the GOSE library carries an authentication tag that does not depend on the ciphertext. This breaks the integrity protection of the encrypted data, allowing undetected ciphertext tampering.
Potential Impact
The impact is that ciphertext integrity is completely removed for AES-CBC-HMAC JWEs generated or verified by the affected versions of Eclipse KeyPont - GOSE. Attackers can modify ciphertext without detection, potentially leading to unauthorized data manipulation or other cryptographic attacks relying on integrity checks.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor Eclipse Foundation advisories for updates and apply any forthcoming patches promptly.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- eclipse
- Date Reserved
- 2026-09-11T13:55:59.296Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6adb25cc4d27ba8daaefef49
Added to database: 10/23/2026, 09:15:56 UTC
Last enriched: 10/23/2026, 09:30:18 UTC
Last updated: 10/23/2026, 09:30:18 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.