{"cve":"CVE-2026-32953","nvd":{"published":"2026-03-20T05:16:14.720","modified":"2026-06-17T10:36:37.703","status":"Analyzed","description":"Tillitis TKey Client package is a Go package for a TKey client. Versions 1.2.0 and below contain a critical bug in the tkeyclient Go module which causes 1 out of every 256 User Supplied Secrets (USS) to be silently ignored, producing the same Compound Device Identifier (CDI)—and thus the same key material—as if no USS is provided. This happens because a buffer index error overwrites the USS-enabled boolean with the first byte of the USS digest, so any USS whose hash starts with 0x00 is effectively discarded. This issue has been fixed in version 1.3.0. Users unable to upgrade immediately should switch to a USS whose hash does not begin with a zero byte.","cvss_v4":{"vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H","score":4.7},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":4.6},"cwes":["CWE-303"],"references":["https://github.com/tillitis/tkeyclient/commit/4954dccf0287657edf8d405057e134cdff9c59e8","https://github.com/tillitis/tkeyclient/releases/tag/v1.3.0","https://github.com/tillitis/tkeyclient/security/advisories/GHSA-4w7r-3222-8h6v"],"products":["tillitis:tkey_client"],"source":"nvd","synced_at":"2026-10-19T22:26:19.218427112+00:00"},"epss":{"cve":"CVE-2026-32953","score":0.0025,"percentile":0.16405,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-4w7r-3222-8h6v","url":"https://osv.dev/vulnerability/GHSA-4w7r-3222-8h6v","summary":"Tillitis TKey Client has an Error in Protocol Implementation","modified":"2026-03-23T18:55:59.335700Z","packages":[{"ecosystem":"Go","name":"github.com/tillitis/tkeyclient","purl":"pkg:golang/github.com/tillitis/tkeyclient","ranges":["<1.3.0"],"fixed":["1.3.0"]}]},{"id":"GO-2026-4728","url":"https://osv.dev/vulnerability/GO-2026-4728","summary":"Tillitis TKey Client has an Error in Protocol Implementation in github.com/tillitis/tkeyclient","modified":"2026-03-23T18:45:15.207431Z","packages":[{"ecosystem":"Go","name":"github.com/tillitis/tkeyclient","purl":"pkg:golang/github.com/tillitis/tkeyclient","ranges":["<1.3.0"],"fixed":["1.3.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}