Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-53939— OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption

Quick assessment

Affected
OpenIDC cjose
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenIDC/cjose 是一个实现 JavaScript 对象签名和加密（JOSE）的 C 语言库。在 0.6.1 至 0.6.2.5 版本中，当使用 AES-CBC-HMAC 内容加密算法（ 、 或 ）并结合任何会生成全新内容加密密钥（CEK）的密钥管理算法来加密 JWE 时，生成的 CEK 全为零字节，而非随机生成。因此，生成的 JWE 是使用一个固定的、公开已知的密钥进行加密和认证的，这意味着任何获得该 JWE 的人都可以还原明文，并伪造或修改其内容。该问题已在版本 0.6.2.6 中修复： 函数现在通过

CVSS 9.1 · Critical EPSS 0.03% · P9
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53939

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption
Source: CVE Program / CVE List V5
Vulnerability Description
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm (`A128CBC-HS256`, `A192CBC-HS384`, or `A256CBC-HS512`) together with any key-management algorithm that generates a fresh content-encryption key (CEK), the CEK is all zero bytes instead of being randomly generated. The resulting JWE is therefore encrypted and authenticated under a fixed, publicly known key, so anyone who obtains the JWE can recover the plaintext and forge or modify the content. This is fixed in version 0.6.2.6 by `_cjose_jwe_set_cek_aes_cbc()` generating the CEK from `RAND_bytes`. A regression test asserts that the `encrypted_key` differs across two encryptions for each AES-CBC-HMAC variant. Until upgrading, for data encrypted with cjose, three options are available. Use an AES-GCM `enc` (`A128GCM` / `A192GCM` / `A256GCM`) instead of an AES-CBC-HMAC `enc`, use `alg=dir` with a caller-supplied CEK, or avoid using cjose for JWE encryption with the affected algorithm pair. These are mitigations for new ciphertexts only; data already encrypted under the zero key remains compromised and should be re-encrypted (and any secrets it contained rotated).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用硬编码的密码学密钥
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
OpenIDC cjose >= 0.6.1, < 0.6.2.6 -

II. Public POCs for CVE-2026-53939

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53939

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-53939 (2)

Vendor Advisories for CVE-2026-53939 (1)

IV. Related Vulnerabilities

Same product: cjose
Same vendor: OpenIDC
Same weakness: CWE-321

V. Comments for CVE-2026-53939

No comments yet

Leave a comment