CVE-2026-32953
Tillitis: TKey Client has an Error in Protocol Implementation
- State
- Published
- Severity
- 4.7 Medium
- Published
- Mar 20, 2026
- Updated
- Mar 20, 2026
- Reserved
- Mar 17, 2026
Description
Tillitis TKey Client package is a Go package for a TKey client. Versions 1.2.0 and below contain a critical bug in the tkeyclient Go module which causes 1 out of every 256 User Supplied Secrets (USS) to be silently ignored, producing the same Compound Device Identifier (CDI)—and thus the same key material—as if no USS is provided. This happens because a buffer index error overwrites the USS-enabled boolean with the first byte of the USS digest, so any USS whose hash starts with 0x00 is effectively discarded. This issue has been fixed in version 1.3.0. Users unable to upgrade immediately should switch to a USS whose hash does not begin with a zero byte.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.7 Medium | CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H | GitHub_M |
Weaknesses
- CWE-303 Incorrect Implementation of Authentication Algorithm
Affected Products
| Product | Versions |
|---|---|
tkeyclienttillitis |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.