Search: CVE-2026-53939

OpenIDC cjose versions 0.6.1 through 0.6.2.5 contain a critical vulnerability where the content-encryption key (CEK) used in AES-CBC-HMAC algorithms is hard-coded to all zero bytes instead of being randomly generated. This flaw allows anyone with access to the encrypted JSON Web Encryption (JWE) token to decrypt and modify its contents. The issue is fixed in version 0.6.2.6 by properly generating the CEK using a secure random function. Until upgrading, mitigations include using AES-GCM encryption, supplying a CEK directly, or avoiding the affected encryption algorithms. Data encrypted with the vulnerable versions should be re-encrypted and secrets rotated.