CVE-2026-32953 Details
Description
Tillitis TKey Client package is a Go package for a TKey client. Versions 1.2.0 and below contain a critical bug in the tkeyclient Go module which causes 1 out of every 256 User Supplied Secrets (USS) to be silently ignored, producing the same Compound Device Identifier (CDI)—and thus the same key material—as if no USS is provided. This happens because a buffer index error overwrites the USS-enabled boolean with the first byte of the USS digest, so any USS whose hash starts with 0x00 is effectively discarded. This issue has been fixed in version 1.3.0. Users unable to upgrade immediately should switch to a USS whose hash does not begin with a zero byte.
A vulnerability exists in the Tillitis TKey Client Go package, specifically in versions through 1.2.0. The issue arises from a buffer index error that causes 1 out of every 256 User Supplied Secrets (USS) to be silently ignored. This flaw results in the same Compound Device Identifier (CDI) being produced as if no USS was provided, thereby compromising the uniqueness of the key material. The vulnerability occurs because the first byte of the USS digest, when it starts with a zero, overwrites a boolean flag that indicates whether the USS is being used. As a consequence, any USS whose hash begins with 0x00 is effectively discarded. This problem has been addressed in version 1.3.0 of the package.
Users should upgrade to Tillitis TKey Client version 1.3.0, which fixes the vulnerability by correctly handling the USS digest. For those unable to upgrade immediately, it is recommended to use a USS that does not hash to a value beginning with a zero byte.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-303 | Incorrect Implementation of Authentication Algorithm | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tillitis tkey client | < 1.3.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | New CVE Received | [email protected] |