Most recent entries from all

EUVD-2026-276715

2026-10-05T22:04:45.957539+00:00

EUVD-2026-276715

fkie_cve-2026-32953

2026-10-05T22:04:45.957575+00:00

Tillitis TKey Client package is a Go package for a TKey client. Versions 1.2.0 and below contain a critical bug in the tkeyclient Go module which causes 1 out of every 256 User Supplied Secrets (USS) to be silently ignored, producing the same Compound Device Identifier (CDI)—and thus the same key material—as if no USS is provided. This happens because a buffer index error overwrites the USS-enabled boolean with the first byte of the USS digest, so any USS whose hash starts with 0x00 is effectively discarded. This issue has been fixed in version 1.3.0. Users unable to upgrade immediately should switch to a USS whose hash does not begin with a zero byte.

GHSA-4w7r-3222-8h6v — Tillitis TKey Client has an Error in Protocol Implementation

2026-10-05T22:04:45.957613+00:00

Affected: Go: github.com/tillitis/tkeyclient

## Impact

Some specific (1 out of 256) User Supplied Secrets (USS) were not used, making the resulting Compound Device Identifier (CDI) the same as if no USS was provided.

Affected client applications: all client apps using the [tkeyclient](https://github.com/tillitis/tkeyclient) Go module.

## Patches

Upgrade to v1.3.0.

**NOTE WELL**: For the affected end users upgrading an app containing `tkeyclient` to v1.3.0 means their key material will change. An end user can get their old keys by not entering any USS. Please make sure to communicate this to end users.

## Affected users

The steps required to assess whether your USS is vulnerable may vary depending on the client application. The example below shows how to perform the check using `tkey-ssh-agent` and the known vulnerable USS `adl`.

1. Insert the TKey into the client 2. Run `tkey-ssh-agent -p --uss` 3. When prompted for a User Supplied Secret, enter `adl` 4. Note the public key and call it `pubkey-with-uss` 5. Remove the TKey from the client 6. Insert the TKey into the client again 7. Run `tkey-ssh-agent -p` 8. Note the public key and call it `pubkey-without-uss`

Expected behavior: `pubkey-with-uss` and `pubkey-without-uss` should not be equal.

Observed behavior: `pubkey-with-uss` and `pubkey-without-uss` are equal.

## Workaround

We recommend everyone using `tkeyclient` to update to v1.3.0 and release new versions of the client apps using it.

However, end users that are unable to upgrade to a new version of a…

UBUNTU-CVE-2026-32953

2026-10-05T22:04:45.957667+00:00

Affected: Ubuntu:25.10: golang-github-tillitis-tkeyclient, Ubuntu:26.04:LTS: golang-github-tillitis-tkeyclient