CVE-2026-113799 abdolence CVE debrief

Who should care

Defenders managing Slack callback endpoints and application/service logs should assess exposure and prioritize verification and remediation efforts. They must verify and upgrade to slack-morphism version 2.28.0 or later, review logs for potential exploitation attempts, and implement additional logging and monitoring to detect potential attacks. Defenders should also confirm whether affected product deployments exist in managed environments and assign an

Why it matters

Defenders should prioritize verifying and upgrading to slack-morphism version 2.28.0 or later, and review logs for potential exploitation attempts, as an attacker can use the verifier as a chosen-message HMAC oracle to recover the correct signature from log entries and resend requests within the five-minute freshness window.

• An attacker can use the verifier as a chosen-message HMAC oracle to recover the correct signature from log entries.
• An attacker can resend a request with an invalid signature within the five-minute freshness window and have it pass Slack Morphism's signature verification.
• Defenders need to verify and upgrade to slack-morphism version 2.28.0 or later to prevent exploitation.

Technical summary

The vulnerability is in Slack Morphism's request signature verification error path. For an invalid request, `slack-morphism` computes the correct signature for the attacker-controlled timestamp and request body and stores it in `SlackEventWrongSignatureError.generated_hash`. The error's `Debug` and `Display` representations expose that value, and the default Axum listener error handler logs it at error level.

Defensive priority

Defenders should prioritize verifying and upgrading to slack-morphism version 2.28.0 or later, and review logs for potential exploitation attempts.

Recommended defensive actions

• Verify and upgrade to slack-morphism version 2.28.0 or later
• Review logs for potential exploitation attempts
• Implement additional logging and monitoring to detect potential attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is in Slack Morphism's request signature verification error path. An attacker who can both reach the application's Slack callback endpoint and read its application/service logs can use the verifier as a chosen-message HMAC oracle.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.