GitHub Advisoryadvisory · Go

GHSA-gxhx-2686-5h9g slack-go `SecretsVerifier` accepts empty signing secret without precondition

MEDIUM Published 2026-05-14 Modified 2026-06-29 Official page ↗
Ecosystem
Go
Packages
github.com/slack-go/slack
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-1391, CWE-287, CWE-326
Reviewed
2026-05-14

Affected packages

• Go github.com/slack-go/slack: < 0.23.1 → fixed in 0.23.1

Description

`SecretsVerifier` in slack-go/slack before v0.23.1 accepts an empty signing secret without error. If an application is misconfigured (e.g., an unset or empty `SLACK_SIGNING_SECRET`), `NewSecretsVerifier` builds an HMAC-SHA256 keyed with an empty string, allowing an unauthenticated attacker to forge a valid `X-Slack-Signature` and bypass Slack request authentication. Fixed in v0.23.1, which rejects empty secrets with `ErrInvalidConfiguration`. This is patched in version 0.23.1.

Related

Weakness · CWE (3)

  • CWE-1391 Use of Weak Credentials weakness
  • CWE-287 Improper Authentication weakness
  • CWE-326 Inadequate Encryption Strength weakness

References