CVE-2026-53939

OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption

Published Sep 8, 2026 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Description

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm (`A128CBC-HS256`, `A192CBC-HS384`, or `A256CBC-HS512`) together with any key-management algorithm that generates a fresh content-encryption key (CEK), the CEK is all zero bytes instead of being randomly generated. The resulting JWE is therefore encrypted and authenticated under a fixed, publicly known key, so anyone who obtains the JWE can recover the plaintext and forge or modify the content. This is fixed in version 0.6.2.6 by `_cjose_jwe_set_cek_aes_cbc()` generating the CEK from `RAND_bytes`. A regression test asserts that the `encrypted_key` differs across two encryptions for each AES-CBC-HMAC variant. Until upgrading, for data encrypted with cjose, three options are available. Use an AES-GCM `enc` (`A128GCM` / `A192GCM` / `A256GCM`) instead of an AES-CBC-HMAC `enc`, use `alg=dir` with a caller-supplied CEK, or avoid using cjose for JWE encryption with the affected algorithm pair. These are mitigations for new ciphertexts only; data already encrypted under the zero key remains compromised and should be re-encrypted (and any secrets it contained rotated).

Analysis

Technical impact

OpenIDC cjose, a C library for JOSE, created the content‑encryption key (CEK) as all zero bytes for each AES‑CBC‑HMAC algorithm instance between versions 0.6.1 and 0.6.2.5. As a result, every JWE issued with these algorithms is protected under a publicly known key, allowing anyone who obtains such ciphertext to decrypt it and forge or alter its contents. The weakness lies in improper key generation and randomization, directly undermining the confidentiality and integrity guarantees of the encryption scheme.

Affected Systems

The flaw affects the OpenIDC cjose library, specifically releases 0.6.1 through 0.6.2.5. Any system using cjose to create or parse JWE payloads that employ the A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 algorithms is impacted.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.1, reflecting its high severity. The EPSS score is not available and the issue is not yet listed in CISA KEV, but the exploitation path is straightforward: any party who can intercept or otherwise access a JWE encrypted with the vulnerable algorithms can recover the plaintext due to the known zero key, and can consequently forge messages and subvert the integrity of communications. Because the key generation flaw is deterministic and global per library version, the attack can be executed without user interaction or additional system compromise.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OpenIDC

cjose

affected

Version	Status	Constraints
`>= 0.6.1, < 0.6.2.6`	affected	—

No data.

Vendor Product Versions

Openidc

Cjose

Version	Status	Scheme	Platform
`[0.6.1,0.6.2.6)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the OpenIDC cjose library to version 0.6.2.6 or later, where CEKs are generated with a secure random source.
For ciphertexts already produced with the vulnerable library, re‑encrypt them using a newer library version or rotate any secrets they protected, and replace the compromised data in all relevant systems.
If an upgrade is temporarily infeasible, avoid the affected algorithms by configuring JWE encryption to use AES‑GCM variants (A128GCM, A192GCM, A256GCM) or by supplying your own key with alg=dir; otherwise, refrain from using cjose for JWE encryption until the patch is applied.

Generated by OpenCVE AI on September 9, 2026 at 08:31 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4887-1	cjose security update
Debian DSA	DSA-6499-1	cjose security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.245% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/OpenIDC/cjose/commit/2a6e5bd969fa20059fb00913fb9f57d77ea6a4d9
https://github.com/OpenIDC/cjose/releases/tag/v0.6.2.6
https://github.com/OpenIDC/cjose/security/advisories/GHSA-f6wf-pqg3-6wqq

History

Sep 13, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Openidc Openidc cjose
Vendors & Products		Openidc Openidc cjose

Sep 9, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 8, 2026 11:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm (`A128CBC-HS256`, `A192CBC-HS384`, or `A256CBC-HS512`) together with any key-management algorithm that generates a fresh content-encryption key (CEK), the CEK is all zero bytes instead of being randomly generated. The resulting JWE is therefore encrypted and authenticated under a fixed, publicly known key, so anyone who obtains the JWE can recover the plaintext and forge or modify the content. This is fixed in version 0.6.2.6 by `_cjose_jwe_set_cek_aes_cbc()` generating the CEK from `RAND_bytes`. A regression test asserts that the `encrypted_key` differs across two encryptions for each AES-CBC-HMAC variant. Until upgrading, for data encrypted with cjose, three options are available. Use an AES-GCM `enc` (`A128GCM` / `A192GCM` / `A256GCM`) instead of an AES-CBC-HMAC `enc`, use `alg=dir` with a caller-supplied CEK, or avoid using cjose for JWE encryption with the affected algorithm pair. These are mitigations for new ciphertexts only; data already encrypted under the zero key remains compromised and should be re-encrypted (and any secrets it contained rotated).
Title		OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption
Weaknesses		CWE-321 CWE-330
References		https://github.com/OpenIDC/cjose/commit/2a6e5bd969fa20059fb00913fb9f57d77ea6a4d9 https://github.com/OpenIDC/cjose/releases/tag/v0.6.2.6 https://github.com/OpenIDC/cjose/security/advisories/GHSA-f6wf-pqg3-6wqq
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}`