Slack Morphism verifier errors disclose valid HMACs in the logs

影響: rust:slack-morphism >= 1.0.0, <= 2.27.0 → 2.28.0

Slack Morphism exposes the correct Slack request HMAC when signature verification fails. For an invalid request, slack-morphism computes the correct signature for the attacker-controlled timestamp and request body and stores it in SlackEventWrongSignatureError.generated_hash. The error's Debug and Display representations expose that value, and the default Axum listener error handler logs it at error level. An attacker who can both reach the application's Slack callback endpoint and read…

Read on GitHub Advisory Database

On 10/22/2026, 01:38 AM, GitHub Advisory Database published "Slack Morphism verifier errors disclose valid HMACs in the logs" (type: Advisory). Severity is "Medium" (medium). Related technologies: Rust, Slack. CVE: CVE-2026-113799.