slack-go `SecretsVerifier` accepts empty signing secret without precondition

published 2026-05-14 6mo ago modified 2026-09-10 2mo ago also GO-2026-5410

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

`SecretsVerifier` in slack-go/slack before v0.23.1 accepts an empty signing secret without error. If an application is misconfigured (e.g., an unset or empty `SLACK_SIGNING_SECRET`), `NewSecretsVerifier` builds an HMAC-SHA256 keyed with an empty string, allowing an unauthenticated attacker to forge a valid `X-Slack-Signature` and bypass Slack request authentication. Fixed in v0.23.1, which rejects empty secrets with `ErrInvalidConfiguration`. This is patched in version 0.23.1.

Patch / fix

fixed in 1 links 2

go github.com/slack-go/slack 0.23.1

github.com/slack-go/slack@34ad5c0 commit
github.com/slack-go/slack/releases/tag/v0.23.1 release

Is GHSA-gxhx-2686-5h9g in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
go	github.com/slack-go/slack	<0.23.1	0.23.1

Classification

Weakness

CWE-1391 Use of Weak Credentials
CWE-287 Improper Authentication
CWE-326 Inadequate Encryption Strength

References

github.com /slack-go/slack/commit/34ad5c052e446f58505ae8d81a2a72821de107cc
web, patch
github.com /slack-go/slack/security/advisories/GHSA-gxhx-2686-5h9g
web, advisory
github.com /slack-go/slack
package
github.com /slack-go/slack/releases/tag/v0.23.1
web

Sources

GitHub Advisory GHSA-gxhx-2686-5h9g
OSV GO-2026-5410

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.