Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.8

Slack-Go SecretsVerifier accepts empty signing secret

published 5 months ago
Summary

An issue with Slack-Go's SecretsVerifier allows an attacker to bypass security checks if they know the secret is empty. This means that if an attacker has access to the secret, they can potentially access sensitive information without needing to authenticate. To fix this, update to a version of Slack-Go that has this issue resolved.

What to do
  • Update github.com slack-go to version 0.23.1.
  • Update slack-go github.com/slack-go/slack to version 0.23.1.
Affected software
Ecosystem VendorProductAffected versions
go github.com slack-go < 0.23.1
Fix: upgrade to 0.23.1
Go slack-go github.com/slack-go/slack < 0.23.1
Fix: upgrade to 0.23.1
Original advisory text
slack-go `SecretsVerifier` accepts empty signing secret without precondition
`SecretsVerifier` in slack-go/slack before v0.23.1 accepts an empty signing secret without error. If an application is misconfigured (e.g., an unset or empty `SLACK_SIGNING_SECRET`), `NewSecretsVerifier` builds an HMAC-SHA256 keyed with an empty string, allowing an unauthenticated attacker to forge a valid `X-Slack-Signature` and bypass Slack request authentication. Fixed in v0.23.1, which rejects empty secrets with `ErrInvalidConfiguration`. This is patched in version 0.23.1.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.8 Medium
Type
CWE-287Improper Authentication
CWE-326Inadequate Encryption Strength
CWE-1391Use of Weak Credentials
Timeline
Published14 May 2026
Updated23 Jul 2026
First seen14 May 2026
Sources
GHSA-gxhx-2686-5h9g · GHSA
GO-2026-5410 · OSV
Track software like this
Free during beta