CVE-2026-53939

A critical vulnerability in the OpenIDC cjose C library allows attackers to decrypt and modify JWEs because the encryption key is fixed to zero bytes.

Key Points:

CVE-2026-53939 affects cjose versions 0.6.1 through 0.6.2.5, scoring 9.1 on the CVSS scale. The bug causes the content-encryption key to be all zero bytes when using specific AES-CBC-HMAC algorithms. Attackers can recover plaintext and forge JWE content without needing authentication or network access. The issue is fixed in version 0.6.2.6, but data encrypted by older versions remains compromised and requires re-encryption.

The vulnerability stems from a failure in the cjose jwe set cek aes cbc() function, which was supposed to generate a random content-encryption key. Instead, it initialized the key as all zero bytes. This means that any JWE encrypted using the affected AES-CBC-HMAC algorithms (A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512) is protected by a fixed, publicly known key. Consequently, anyone who obtains the ciphertext can easily decrypt it to reveal the original data or modify the content and re-encrypt it, bypassing integrity checks.

The impact is significant because no authentication is required for exploitation; the flaw is inherent to the cryptographic process. While the fix in version 0.6.2.6 ensures proper randomness using RAND bytes, it does not retroactively secure data already encrypted by the vulnerable versions. Organizations using the affected library must immediately re-encrypt existing data and rotate any secrets that were contained within those JWEs. Until the upgrade is complete, using AES-GCM algorithms or direct key management can mitigate risks for new encryptions, but existing data remains exposed.

How are you tracking dependencies that use the cjose library in your stack?

Learn More: The Hacker Wire

Want to stay updated on the latest cyber threats?

👉 Subscribe to /r/PwnHub