CVE-2026-113799

Deferred Deferred - Pending Action

HMAC Oracle in Slack Morphism Library

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description

Slack Morphism is a client library for Slack Web/Events API/Socket Mode and Block Kit. Versions 1.0.0 through 2.27.0 expose the correct Slack request HMAC when signature verification fails. For an invalid request, `slack-morphism` computes the correct signature for the attacker-controlled timestamp and request body and stores it in `SlackEventWrongSignatureError.generated_hash`. The error's `Debug` and `Display` representations expose that value, and the default Axum listener error handler logs it at error level. An attacker who can both reach the application's Slack callback endpoint and read its application/service logs can therefore use the verifier as a chosen-message HMAC oracle. The attacker can send an arbitrary request with an invalid signature, recover the correct signature from the resulting log entry, and resend the same request within the five-minute freshness window. The second request passes Slack Morphism's signature verification and reaches the protected application callback without the attacker knowing the Slack signing secret. Version 2.28.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-113799

EUVD

EUVD-2026-107388

Affected Vendors & Products

Vendor	Product	Version / Range
abdolence	slack-morphism-rust	>= 1.0.0, < 2.28.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-532	The product writes sensitive information to a log file.

Attack-Flow Graph

Executive Summary

Slack Morphism versions 1.0.0 through 2.27.0 expose valid HMACs in error logs when signature verification fails. The library computes the correct HMAC for attacker-controlled requests and stores it in a public error field called generated_hash. This value is logged at error level by default handlers, allowing attackers with log access to extract the HMAC and replay requests within a five-minute window.

Detection Guidance

Check application logs for error entries containing 'generated_hash' or full HMAC values in Slack Morphism error messages. Look for Axum or Hyper error logs with signature-related fields. Verify if Slack callback endpoints log detailed error responses that expose HMACs.

Impact Analysis

An attacker could gain unauthorized access to your Slack callback endpoint by replaying a previously rejected request with a valid signature. This bypasses the need to know the Slack signing secret. The impact includes potential data breaches, unauthorized actions, or further exploitation of the application.

Compliance Impact

This vulnerability may violate compliance requirements by exposing sensitive information (HMACs) in logs, which could be considered a data breach under GDPR or HIPAA. Logging valid credentials or signatures may lead to unauthorized access and fail security controls for data protection and integrity.

Mitigation Strategies

Upgrade to slack-morphism-rust version 2.28.0 or later to patch the issue. Review and sanitize error handling in Axum/Hyper integrations to avoid logging full HMACs. Monitor logs for any exposure of generated_hash values and rotate Slack signing secrets if logs were compromised.

Hi! I’m here to help you understand CVE-2026-113799. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...