CVE-2026-53939
Received Received - Intake

Null CEK in AES-CBC-HMAC Encryption in cjose

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: GitHub, Inc.

Description
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm (`A128CBC-HS256`, `A192CBC-HS384`, or `A256CBC-HS512`) together with any key-management algorithm that generates a fresh content-encryption key (CEK), the CEK is all zero bytes instead of being randomly generated. The resulting JWE is therefore encrypted and authenticated under a fixed, publicly known key, so anyone who obtains the JWE can recover the plaintext and forge or modify the content. This is fixed in version 0.6.2.6 by `_cjose_jwe_set_cek_aes_cbc()` generating the CEK from `RAND_bytes`. A regression test asserts that the `encrypted_key` differs across two encryptions for each AES-CBC-HMAC variant. Until upgrading, for data encrypted with cjose, three options are available. Use an AES-GCM `enc` (`A128GCM` / `A192GCM` / `A256GCM`) instead of an AES-CBC-HMAC `enc`, use `alg=dir` with a caller-supplied CEK, or avoid using cjose for JWE encryption with the affected algorithm pair. These are mitigations for new ciphertexts only; data already encrypted under the zero key remains compromised and should be re-encrypted (and any secrets it contained rotated).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-09
Last Modified
2026-09-09
Generated
2026-09-09
AI Q&A
2026-09-09
EPSS Evaluated
N/A
NVD
CVE-2026-53939

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
openidc cjose 0.6.1
openidc cjose 0.6.2
openidc cjose 0.6.2.5
openidc cjose 0.6.2.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-330 The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the cjose library versions 0.6.1 through 0.6.2.5. When encrypting data using AES-CBC-HMAC algorithms (A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512) with certain key-management algorithms, the content-encryption key (CEK) is incorrectly set to all zero bytes instead of being randomly generated. This results in the encrypted data being protected by a fixed, publicly known key, allowing anyone with access to the data to decrypt it or modify its contents.

Detection Guidance

To detect this vulnerability, check the version of cjose installed on your system. Run: cjose --version or check package managers like apt list --installed | grep cjose. If the version is between 0.6.1 and 0.6.2.5, the system is vulnerable. Additionally, inspect JWE tokens encrypted with AES-CBC-HMAC algorithms (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) for improperly generated CEKs.

Impact Analysis

If you use cjose to encrypt sensitive data with the affected algorithms, attackers can decrypt the data or forge/modify its contents because the encryption key is predictable. Previously encrypted data remains compromised even after upgrading, requiring re-encryption and secret rotation. The vulnerability impacts confidentiality and integrity of the encrypted data.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and integrity, such as GDPR's encryption standards or HIPAA's safeguards for protected health information. Using a fixed encryption key undermines cryptographic best practices and could result in non-compliance due to unauthorized access or data tampering risks.

Mitigation Strategies

Immediately upgrade cjose to version 0.6.2.6 or later. If upgrading is not possible, switch to AES-GCM encryption modes (A128GCM, A192GCM, A256GCM) or use alg=dir with a caller-supplied CEK. Avoid using cjose for JWE encryption with affected algorithm pairs. Re-encrypt previously encrypted data and rotate any exposed secrets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53939. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart