CVE-2026-113799

Name of the Vulnerable Software and Affected Versions Slack Morphism versions 1.0.0 through 2.27.0

Description Slack Morphism exposes the correct Slack request HMAC (Hash-based Message Authentication Code) when signature verification fails. For an invalid request, the library computes the correct signature for the attacker-controlled timestamp and request body and stores it in the generated hash field of the SlackEventWrongSignatureError object. This value is exposed through the error's Debug and Display representations and is logged at the error level by the default Axum listener error handler.

An attacker with network access to the application's Slack callback endpoint and read access to the application logs can use the verifier as a chosen-message HMAC oracle. By sending a request with an invalid signature, the attacker can recover the correct signature from the logs and resend the identical request within the five-minute freshness window. This allows the request to bypass signature verification and reach the protected application callback without the attacker knowing the Slack signing secret.

Recommendations Update to version 2.28.0. Rotate the Slack signing secret if logs containing generated hash values were accessible to untrusted parties.