Skip to content
Fencer Vulns
critical 9.1

CVE-2026-53939 json

OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption

published 2026-09-08 2 mo ago modified 2026-09-10 59 d ago also EUVD-2026-74299

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 15%
public exploits
0
none known

Summary

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm (`A128CBC-HS256`, `A192CBC-HS384`, or `A256CBC-HS512`) together with any key-management algorithm that generates a fresh content-encryption key (CEK), the CEK is all zero bytes instead of being randomly generated. The resulting JWE is therefore encrypted and authenticated under a fixed, publicly known key, so anyone who obtains the JWE can recover the plaintext and forge or modify the content. This is fixed in version 0.6.2.6 by `_cjose_jwe_set_cek_aes_cbc()` generating the CEK from `RAND_bytes`. A regression test asserts that the `encrypted_key` differs across two encryptions for each AES-CBC-HMAC variant. Until upgrading, for data encrypted with cjose, three options are available. Use an AES-GCM `enc` (`A128GCM` / `A192GCM` / `A256GCM`) instead of an AES-CBC-HMAC `enc`, use `alg=dir` with a caller-supplied CEK, or avoid using cjose for JWE encryption with the affected algorithm pair. These are mitigations for new ciphertexts only; data already encrypted under the zero key remains compromised and should be re-encrypted (and any secrets it contained rotated).

Patch / fix

  • cjose Debian 12 0.6.2.1-1+deb12u2
  • cjose Debian 13 0.6.2.3-1+deb13u1
  • cjose Debian 14 0.6.2.7-1

debian advisories DEBIAN-CVE-2026-53939

  • cjose RHEL 10.2 0.6.2.2-7.el10_2.2
  • cjose enterprise linux eus 10.0 0.6.2.2-7.el10_0.2

red hat advisories RHSA-2026:83224RHSA-2026:80605

  • cjose SLES for SAP applications 16.0, SLES 16.0 0.6.2.3-160000.3.1
  • cjose SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 0.6.1-150100.4.9.1
  • cjose SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Server Applications 15 SP7 0.6.1-150600.18.3.1
  • cjose SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 0.6.1-7.8.1

suse advisories SUSE-SU-2026:23910-1SUSE-SU-2026:4253-1SUSE-SU-2026:4251-1SUSE-SU-2026:4237-1

  • cjose openSUSE Leap 16.0 0.6.2.3-160000.3.1
  • cjose openSUSE Tumbleweed 0.6.2.8-2.1

opensuse advisories openSUSE-SU-2026:21944-1openSUSE-SU-2026:11784-1

  • cjose AlmaLinux 8 0.6.1-6.module_el8.10.0+4330+15616d81
  • mod_auth_openidc AlmaLinux 8 2.4.9.4-9.module_el8.10.0+4297+63ae3533
  • cjose AlmaLinux 9 0.6.1-17.el9_8.2
  • cjose AlmaLinux 10 0.6.2.2-7.el10_2.2

almalinux advisories ALSA-2026:92157ALSA-2026:92145ALSA-2026:80605

  • cjose Rocky Linux 9 0.6.1-17.el9_8.2
  • mod_auth_openidc Rocky Linux 8 2.4.9.4-9.module+el8.10.0+40373+8a3f15d2
  • cjose Rocky Linux 10 0.6.2.2-7.el10_2.2

rocky linux advisories RLSA-2026:92145RLSA-2026:92157RLSA-2026:80605

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-53939 updated cvss 9.1

cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption

  • Red Hat CodeReady Linux Builder EUS (v.9.6) cjose-devel 0.6.1-17.el9_6.2, cjose-debuginfo 0.6.1-17.el9_6.2, cjose-debugsource 0.6.1-17.el9_6.2
    fixed: vendor fix RHSA-2026:92154
  • Red Hat Enterprise Linux AppStream (v. 8) cjose 0.6.1-6.module+el8.10.0+25174+9c399f63, mod_auth_openidc 2.4.9.4-9.module+el8.10.0+24880+4db9166e
    fixed: vendor fix RHSA-2026:92157
  • Red Hat Enterprise Linux AppStream (v. 9) cjose 0.6.1-17.el9_8.2
    fixed: vendor fix RHSA-2026:92145
  • Red Hat Enterprise Linux AppStream (v. 10) cjose 0.6.2.2-7.el10_2.2
    fixed: vendor fix RHSA-2026:80605
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) cjose 0.6.1-3.module+el8.4.0+25223+40c6a3da.2, mod_auth_openidc 2.4.9.4-1.module+el8.4.0+24868+593d10ef.3
    fixed: vendor fix RHSA-2026:92160
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) cjose 0.6.1-3.module+el8.6.0+25217+11ffe348.2, mod_auth_openidc 2.4.9.4-1.module+el8.6.0+24867+df0294a5.3
    fixed: vendor fix RHSA-2026:92159
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) cjose 0.6.1-3.module+el8.8.0+25209+e122577f.2, mod_auth_openidc 2.4.9.4-1.module+el8.8.0+24885+7d8e9f68.3
    fixed: vendor fix RHSA-2026:92158
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) cjose 0.6.1-13.el9_2.2
    fixed: vendor fix RHSA-2026:92156
show 9 more
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) cjose 0.6.1-16.el9_4.2
    fixed: vendor fix RHSA-2026:92155
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) cjose 0.6.2.2-7.el10_0.2
    fixed: vendor fix RHSA-2026:83224
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) cjose 0.6.1-17.el9_6.2
    fixed: vendor fix RHSA-2026:92154
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) cjose 0.6.1-3.module+el8.4.0+25223+40c6a3da.2, mod_auth_openidc 2.4.9.4-1.module+el8.4.0+24868+593d10ef.3
    fixed: vendor fix RHSA-2026:92160
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) cjose 0.6.1-3.module+el8.6.0+25217+11ffe348.2, mod_auth_openidc 2.4.9.4-1.module+el8.6.0+24867+df0294a5.3
    fixed: vendor fix RHSA-2026:92159
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) cjose 0.6.1-3.module+el8.8.0+25209+e122577f.2, mod_auth_openidc 2.4.9.4-1.module+el8.8.0+24885+7d8e9f68.3
    fixed: vendor fix RHSA-2026:92158
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) cjose-devel 0.6.1-17.el9_8.2, cjose-debuginfo 0.6.1-17.el9_8.2, cjose-debugsource 0.6.1-17.el9_8.2
    fixed: vendor fix RHSA-2026:92145
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) cjose-devel 0.6.2.2-7.el10_2.2, cjose-debuginfo 0.6.2.2-7.el10_2.2, cjose-debugsource 0.6.2.2-7.el10_2.2
    fixed: vendor fix RHSA-2026:80605
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) cjose-devel 0.6.2.2-7.el10_0.2, cjose-debuginfo 0.6.2.2-7.el10_0.2, cjose-debugsource 0.6.2.2-7.el10_0.2
    fixed: vendor fix RHSA-2026:83224

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
1 mo ago

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/OpenIDC/cjose/security/advisories/GHSA-f6wf-pqg3-6wqq referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

  • OpenIDC cjose

Classification

Weakness
  • CWE-321 Use of Hard-coded Cryptographic Key
  • CWE-330 Use of Insufficiently Random Values

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.