CVE-2026-32953

MEDIUM EPSS 15.7%
Published Mar 20, 20263mo ago · Modified Jun 17, 20262w ago
4.7 CVSS 4.0
Medium
Find Similar
Published Mar 20, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

Tillitis TKey Client package is a Go package for a TKey client. Versions 1.2.0 and below contain a critical bug in the tkeyclient Go module which causes 1 out of every 256 User Supplied Secrets (USS) to be silently ignored, producing the same Compound Device Identifier (CDI)—and thus the same key material—as if no USS is provided. This happens because a buffer index error overwrites the USS-enabled boolean with the first byte of the USS digest, so any USS whose hash starts with 0x00 is effectively discarded. This issue has been fixed in version 1.3.0. Users unable to upgrade immediately should switch to a USS whose hash does not begin with a zero byte.

CVSS Details

Base Score
4.7
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Physical
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
15.7% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-303

Affected Products 1

VendorProductVersionRange
tillitistkey_client* <1.3.0

References 3

  • github.com https://github.com/tillitis/tkeyclient/commit/4954dccf0287657edf8d405057e134cdff9c59e8
    Patch
  • github.com https://github.com/tillitis/tkeyclient/releases/tag/v1.3.0
    Release Notes
  • github.com https://github.com/tillitis/tkeyclient/security/advisories/GHSA-4w7r-3222-8h6v
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/tillitis/tkeyclient/commit/4954dccf0287657edf8d405057e134cdff9c59e8
    Patch