CVE-2026-89320 - HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity
CVE ID :CVE-2026-89320 Published : Oct. 23, 2026, 9:17 a.m. | 58 minutes ago Description :`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an...