WS-2026-0061
Published:May 10, 2026
Updated:September 08, 2026
"SecretsVerifier" in slack-go/slack accepts an empty signing secret without error. If an application is misconfigured (for example an unset or empty "SLACK_SIGNING_SECRET"), "NewSecretsVerifier" builds an HMAC-SHA256 keyed with an empty string, allowing an unauthenticated attacker to forge a valid "X-Slack-Signature" and bypass Slack request authentication. Fixed in v0.23.1, which rejects empty secrets with "ErrInvalidConfiguration". The vulnerable "NewSecretsVerifier" function first appears in v0.4.0; earlier releases do not contain it.
Affected Packages
https://github.com/slack-go/slack.git (GITHUB):
Affected version(s) >=v0.4.0 <v0.23.1Fix Suggestion:
Update to version v0.23.1github.com/slack-go/slack (GO):
Affected version(s) >=v0.4.0 <v0.23.1Fix Suggestion:
Update to version v0.23.1Related Resources (3)
Do you need more information?
Contact UsCVSS v4
Base Score:
8.3
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
HIGH
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
6.5
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
HIGH
Availability
NONE