mediumVulnerability
GHSA-gxhx-2686-5h9g
```go func NewSecretsVerifier(header http.Header, secret string) (SecretsVerifier, error) { hash := hmac.New(sha256.New, []byte(secret)) // raw secret, no precondition } ```
Properties
- ghsa_id
- GHSA-gxhx-2686-5h9g
- severity
- medium
- summary
- slack-go `SecretsVerifier` accepts empty signing secret without precondition
- cve_id
- GHSA-gxhx-2686-5h9g
- is_ghsa_only
- true
- ghsa_published
- 2026-05-14T20:52:55Z
- source_url
- https://github.com/advisories/GHSA-gxhx-2686-5h9g
- ghsa_updated
- 2026-05-14T20:52:57Z
Related Entities (6)
VULNERABLE_TO (1)
←[Software]go/github.com/slack-go/slack
AFFECTS (1)
→[Software]go/github.com/slack-go/slack
HAS_WEAKNESS (3)
→[Weakness]Use of Weak Credentials
→[Weakness]Inadequate Encryption Strength
→[Weakness]Improper Authentication
REPORTED_BY (1)
→[Source]GitHub Advisory Database
Explore deeper with Ninja Signal's threat intelligence graph