The slack-go library before version 0.23.1 contains a vulnerability in the SecretsVerifier component where it accepts an empty signing secret without error. This allows an attacker to forge a valid X-Slack-Signature header and bypass Slack request authentication if the application is misconfigured with an empty or unset SLACK_SIGNING_SECRET. The issue is fixed in version 0.23.1, which rejects empty secrets with an explicit error.