https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-14T19:45:50.136469+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/ghsa-gxhx-2686-5h9g GHSA-gxhx-2686-5h9g — slack-go `SecretsVerifier` accepts empty signing secret without precondition 2026-10-14T19:45:50.140291+00:00

Affected: Go: github.com/slack-go/slack

`SecretsVerifier` in slack-go/slack before v0.23.1 accepts an empty signing secret without error. If an application is misconfigured (e.g., an unset or empty `SLACK_SIGNING_SECRET`), `NewSecretsVerifier` builds an HMAC-SHA256 keyed with an empty string, allowing an unauthenticated attacker to forge a valid `X-Slack-Signature` and bypass Slack request authentication. Fixed in v0.23.1, which rejects empty secrets with `ErrInvalidConfiguration`. This is patched in version 0.23.1.