OpenIDC cjose up to 0.6.1/0.6.2.5 _cjose_jwe_set_cek_aes_cbc random values

Summaryinfo

A vulnerability marked as problematic has been reported in OpenIDC cjose up to 0.6.1/0.6.2.5. Affected by this issue is the function _cjose_jwe_set_cek_aes_cbc. Performing a manipulation results in random values. This vulnerability is cataloged as CVE-2026-53939. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in OpenIDC cjose up to 0.6.1/0.6.2.5. It has been classified as problematic. This affects the function _cjose_jwe_set_cek_aes_cbc. The manipulation with an unknown input leads to a random values vulnerability. CWE is classifying the issue as CWE-330. The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. This is going to have an impact on confidentiality. The summary by CVE is:

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm (`A128CBC-HS256`, `A192CBC-HS384`, or `A256CBC-HS512`) together with any key-management algorithm that generates a fresh content-encryption key (CEK), the CEK is all zero bytes instead of being randomly generated. The resulting JWE is therefore encrypted and authenticated under a fixed, publicly known key, so anyone who obtains the JWE can recover the plaintext and forge or modify the content. This is fixed in version 0.6.2.6 by `_cjose_jwe_set_cek_aes_cbc()` generating the CEK from `RAND_bytes`. A regression test asserts that the `encrypted_key` differs across two encryptions for each AES-CBC-HMAC variant. Until upgrading, for data encrypted with cjose, three options are available. Use an AES-GCM `enc` (`A128GCM` / `A192GCM` / `A256GCM`) instead of an AES-CBC-HMAC `enc`, use `alg=dir` with a caller-supplied CEK, or avoid using cjose for JWE encryption with the affected algorithm pair. These are mitigations for new ciphertexts only; data already encrypted under the zero key remains compromised and should be re-encrypted (and any secrets it contained rotated).

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-53939 since 06/11/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1600.001 for this issue.

Upgrading to version 0.6.2.6 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• OpenIDC

Name

• cjose

Version

• 0.6.0
• 0.6.1
• 0.6.2.0
• 0.6.2.1
• 0.6.2.2
• 0.6.2.3
• 0.6.2.4
• 0.6.2.5

Website

• Product: https://github.com/OpenIDC/cjose/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion