CVE-2026-53939Critical· 9.1▾ AbyssalPoC availableOpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm (`A128CBC-HS256`, `A192CBC-HS3…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 50.1 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
Exploit / PoC code exists
0.2% → 0.3%
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm (A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512) together with any key-management algorithm that generates a fresh content-encryption key (CEK), the CEK is all zero bytes instead of being randomly generated. The resulting JWE is therefore encrypted and authenticated under a fixed, publicly known key, so anyone who obtains the JWE can recover the plaintext and forge or modify the content. This is fixed in version 0.6.2.6 by _cjose_jwe_set_cek_aes_cbc() generating the CEK from RAND_bytes. A regression test asserts that the encrypted_key differs across two encryptions for each AES-CBC-HMAC variant. Until upgrading, for data encrypted with cjose, three options are available. Use an AES-GCM enc (A128GCM / A192GCM / A256GCM) instead of an AES-CBC-HMAC enc, use alg=dir with a caller-supplied CEK, or avoid using cjose for JWE encryption with the affected algorithm pair. These are mitigations for new ciphertexts only; data already encrypted under the zero key remains compromised and should be re-encrypted (and any secrets it contained rotated).
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-53938High· 8.2OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE)
CVE-2026-106074Medium· 4.8nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
CVE-2026-55889Medium· 5.3xdg-desktop-portal: xdg-desktop-portal: unauthorized data disclosure via predictable token generation (CVE-2026-55889)
CVE-2019-15847High· 7.5The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator
CVE-2026-71225Medium· 6.5A flaw was found in libkcapi
CVE-2024-52615Medium· 5.3A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries