PT-2023-20533 · Pubnub · Com.Pubnub:Pubnub+7

Varga Daniel · Published 2023-12-05 · Updated 2025-08-20 · CVE-2023-26154

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions pubnub versions prior to 7.4.0 com.pubnub:pubnub all versions github.com/pubnub/go all versions github.com/pubnub/go/v7 versions prior to 7.2.0 pubnub/pubnub versions prior to 6.1.0 pubnub/c-core versions prior to 4.5.0 com.pubnub:pubnub-kotlin versions prior to 7.7.0 pubnub/swift versions prior to 6.2.0

Description The issue is related to insufficient entropy in the implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file. This is due to the inefficient implementation of the getKey function. To exploit this vulnerability, an attacker needs to invest resources in preparing the attack and brute-force the encryption.

Recommendations To resolve the issue, users are encouraged to migrate to the new crypto package introduced in v7.2.0. For versions prior to 7.4.0, consider updating to version 7.4.0 or later. For com.pubnub:pubnub, github.com/pubnub/go, and other affected packages without a specified fixed version, update to the latest version available. As a temporary workaround, consider restricting the use of the vulnerable getKey function until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-331

Related Identifiers

CVE-2023-26154

GHSA-5844-Q3FC-56RH

GO-2023-2385

OPENSUSE-SU-2025:15469-1

Affected Products

Com.Pubnub:Pubnub

Com.Pubnub:Pubnub-Kotlin

Github.Com/Pubnub/Go

Github.Com/Pubnub/Go/V7

Pubnub

Pubnub/C-Core

Pubnub/Pubnub

Pubnub/Swift

References · 48

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/pubnub/CVE-2023-26154.yml · Exploit
• 🔥 https://gist.github.com/vargad/20237094fce7a0a28f0723d7ce395bb0 · Exploit
• https://github.com/pubnub/javascript/commit/fb6cd0417cbb4ba87ea2d5d86a9c94774447e119 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-26154 · Security Note
• https://osv.dev/vulnerability/CVE-2023-26154 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5844-q3fc-56rh · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15469-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-2385 · Vendor Advisory
• https://github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js#L70 · Note
• https://github.com/pubnub/javascript · Note
• https://github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js%23L70 · Note
• https://github.com/pubnub/go/commit/428517fef5b901db7275d9f5a75eda89a4c28e08 · Note
• https://suse.com/security/cve/CVE-2025-53514 · Note
• https://twitter.com/CVEnew/status/1732267368665993436 · Twitter Post
• https://security.snyk.io/vuln/SNYK-PUB-PUBNUB-6098385 · Note