Medium, CVSS 4.7GoPublished
Tillitis TKey Client has an Error in Protocol Implementation
CVE-2026-32953 · GHSA-4w7r-3222-8h6v
- Affected
- Go github.com/tillitis/tkeyclient < 1.3.0
- Fixed in
- 1.3.0· Vendor fix available
- Issue
- Impact Some specific (1 out of 256) User Supplied Secrets (USS) were not used, making the resulting Compound Device Identifier (CDI) the same as if no USS was provided. Affected client applications: all client apps using the tkeyclient Go module. Patches Upgrade to v1.3.0. NOTE WELL: For the affected end users upgrading an app containing tkeyclient to v1.3.0 means their key material will change. An end user can get their old keys by not entering any USS. Please make sure to communicate this to end users. Affected users The steps required to assess whether your USS is vulnerable may vary depending on the client application. The example below shows how to perform the check using tkey-ssh-agent and the known vulnerable USS adl. 1. Insert the TKey into the client 2. Run tkey-ssh-agent -p --uss 3. When prompted for a User Supplied Secret, enter adl 4. Note the public key and call it pubkey-with-uss 5. Remove the TKey from the client 6. Insert the TKey into the client again 7. Run…
Recommended action: Upgrade to 1.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.