ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-113799

Slack Morphism verifier errors disclose valid HMACs in the logs

Published Oct 21, 2026 · catalog updated Oct 21, 2026 · Slack Morphism verifier errors

Last checked Nov 3, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-113799. EPSS is 0.43%. Act only if a listed version of Slack Morphism verifier errors is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Slack Morphism verifier errors).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium5.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.43%
Remediation
Version ranges on file
Affected products
crates.io slack-morphism · rust slack-morphism

### Summary Slack Morphism exposes the correct Slack request HMAC when signature verification fails. For an invalid request, computes the correct signature for the attacker-controlled timestamp and request body and stores it in . The error's and representations expose that value, and the default Axum listener error handler logs it at error level. An attacker who can both reach the application's Slack callback endpoint and read its application/service logs can therefore use the verifier as a chosen-message HMAC oracle. The attacker can send an arbitrary request with an invalid signature, recover the correct signature from the resulting log entry, and resend the same request within the five-minute freshness window. The second request passes Slack Morphism's signature verification and reaches the protected application callback without the attacker knowing the Slack signing secret. I reproduced this end-to-end against both the Axum and Hyper integrations in 2.26.0 and 2.27.0. ### Details The vulnerability is in Slack Morphism's request signature verification error path. In , computes the expected signature before comparing it with the untrusted supplied by the request. On a mismatch, the implementation creates a containing the complete correct signature in its public field. Relevant source path: The error type is defined around: is a public ; the type derives , and its implementation also prints the generated signature. The resulting source-to-sink path is: 1. computes the expected HMAC for the attacker-controlled timestamp and raw request body. 2. Signature verification fails because the attacker initially sends an invalid signature. 3. Slack Morphism places the correct expected value in . 4. The error's and representations reveal that HMAC. 5. The Axum middleware propagates/formats the error through . 6. The default listener error handler in logs the error at error level. 7. The attacker reads the generated HMAC from the logs. 8. The attacker resends the identical tim

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • crates.io slack-morphism1.0.0 → 2.28.0
  • rust slack-morphism>= 1.0.0, <= 2.27.0

How to fix CVE-2026-113799

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-113799. EPSS is 0.43%. Act only if a listed version of Slack Morphism verifier errors is installed.

Which versions are affected?

Compare what you have installed with 1.0.0 → 2.28.0, >= 1.0.0, <= 2.27.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-532: Insertion of Sensitive Information into Log File. EPSS 0.43%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 21, 2026 · GitHub Advisory Database

    Detected

    ### Summary Slack Morphism exposes the correct Slack request HMAC when signature verification fails. For an invalid request, computes the correct signature for the attacker-controlled timestamp and request body and stores it in . The error's and representations expose that value, and the default Axum listener error handler logs it at error level. An attacker who can both reach the application's Sl

  2. Oct 21, 2026 · GitHub Advisory Database

    Fix available

    slack-morphism fixed in 2.28.0

  3. Oct 21, 2026 · GitHub Advisory Database

    Fix available

    slack-morphism fixed in 2.28.0

  4. Oct 21, 2026 · GitHub Advisory Database

    Updated

    ### Summary Slack Morphism exposes the correct Slack request HMAC when signature verification fails. For an invalid request, computes the correct signature for the attacker-controlled timestamp and request body and stores it in . The error's and representations expose that value, and the default Axum listener error handler logs it at error level. An attacker who can both reach the application's Sl

  5. Oct 21, 2026 · NIST NVD

    Updated

    Slack Morphism is a client library for Slack Web/Events API/Socket Mode and Block Kit. Versions 1.0.0 through 2.27.0 expose the correct Slack request HMAC when signature verification fails. For an invalid request, computes the correct signature for the attacker-controlled timestamp and request body and stores it in . The error's and representations expose that value, and the default Axum listener

Sources

  • CVE.orgVulnerability recordCVE-2026-113799

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-113799

    30-day exploitation probability 0.43%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-26w4-8w32-4x3v

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • NIST NVDVulnerability recordCVE-2026-113799

    Slack Morphism is a client library for Slack Web/Events API/Socket Mode and Block Kit. Versions 1.0.0 through 2.27.0 expose the correct Slack request HMAC when signature verification fails. For an invalid request, computes the correct signature for the attacker-c

    nvd.nist.gov
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-26w4-8w32-4x3v

    Slack Morphism verifier errors disclose valid HMACs in the logs

    osv.dev

References

Freshness

Last verified in this catalog Nov 3, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 3, 2026
  • GitHub Advisory DatabaseOct 23, 2026
  • OpenSSF OSV / OSV ScannerOct 23, 2026
  • CVE.orgOct 21, 2026
  • NIST NVDOct 21, 2026