An attacker can exploit a flaw in Slack Morphism where the library exposes the correct Slack request HMAC when signature verification fails. The library stores the calculated HMAC in an error structure, and the default Axum listener logs the error’s debug and display representations, revealing the correct signature. This vulnerability maps to CWE-532, which involves archiving or logging of sensitive information. The impact is that an adversary can capture a valid signature for a crafted message and use it to forge Slack events, bypassing the need for the real signing secret.

The issue affects the abdolence:slack-morphism-rust client library, specifically all versions from 1.0.0 up to and including 2.27.0. No specific newer versions are listed as affected; version 2.28.0 includes the patch.

The CVSS score of 5.3 places the vulnerability in a medium severity bracket. No EPSS data is available, and the CVE is not listed in the CISA KEV catalog, which suggests the exploitation likelihood may not yet be high. However, the attack requires the attacker to have network reach to the Slack callback endpoint and the ability to read the application logs. If an attacker can read logs, they can use the exposed HMAC as a chosen‑message oracle to replay the same request within Slack’s five‑minute freshness window, thereby gaining unauthorized execution of the callback logic. The risk is therefore elevated in environments where logs are exposed or not adequately protected.