slack-go vulnerabilities

Products

• github.com/slack-go/slack 1

Latest slack-go CVEs

Newest publication first

1. GHSA-gxhx-2686-5h9g slack-go `SecretsVerifier` accepts empty signing secret without precondition

   Published 2026-05-14

   Medium·CVSS 4.8

   SecretsVerifier in slack-go/slack before v0.23.1 accepts an empty signing secret without error. If an application is misconfigured (e.g., an unset or empty SLACK_SIGNING_SECRET), NewSecretsVerifier builds an HMAC-SHA256 keyed with an empty string, allowing an unauthenticated atta...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.