Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-113799— Slack Morphism verifier errors disclose valid HMACs in the logs

Quick assessment

Affected
abdolence slack-morphism-rust
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Slack Morphism 是一个用于 Slack Web API、Events API、Socket Mode 以及 Block Kit 的客户端库。在 1.0.0 至 2.27.0 版本中，当签名验证失败时，该库会暴露正确的 Slack 请求 HMAC 值。对于无效请求， 会根据攻击者控制的请求时间戳和请求体计算出正确的签名，并将其存储在 字段中。该错误的 和 表示形式会泄露此值，而默认的 Axum 监听器错误处理程序会以错误级别记录该值。因此，若攻击者既能访问应用的 Slack 回调端点，又能读取其应用或服

CVSS 5.3 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
abdolence slack-morphism-rust >= 1.0.0, < 2.28.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-113799

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Slack Morphism verifier errors disclose valid HMACs in the logs
Source: CVE Program / CVE List V5
Vulnerability Description
Slack Morphism is a client library for Slack Web/Events API/Socket Mode and Block Kit. Versions 1.0.0 through 2.27.0 expose the correct Slack request HMAC when signature verification fails. For an invalid request, `slack-morphism` computes the correct signature for the attacker-controlled timestamp and request body and stores it in `SlackEventWrongSignatureError.generated_hash`. The error's `Debug` and `Display` representations expose that value, and the default Axum listener error handler logs it at error level. An attacker who can both reach the application's Slack callback endpoint and read its application/service logs can therefore use the verifier as a chosen-message HMAC oracle. The attacker can send an arbitrary request with an invalid signature, recover the correct signature from the resulting log entry, and resend the same request within the five-minute freshness window. The second request passes Slack Morphism's signature verification and reaches the protected application callback without the attacker knowing the Slack signing secret. Version 2.28.0 patches the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过日志文件的信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
abdolence slack-morphism-rust >= 1.0.0, < 2.28.0 -

II. Public POCs for CVE-2026-113799

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-113799

请登录查看更多情报信息。

Other References for CVE-2026-113799 (4)

IV. Related Vulnerabilities

Same product: slack-morphism-rust
Same vendor: abdolence
Same weakness: CWE-532

V. Comments for CVE-2026-113799

No comments yet

Leave a comment