PT-2026-25989 · Tillitis · Tillitis Tkey Client+1

Dehanj · Published 2026-01-01 · Updated 2026-03-27 · CVE-2026-32953

Positive Technologies (AI Summary)

CVSS v4.0

4.7

Medium

Base vector

AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Tillitis TKey Client versions 1.2.0 and below Description The Tillitis TKey Client package, a Go package for a TKey client, contains a flaw in the tkeyclient Go module. Approximately 1 out of every 256 User Supplied Secrets (USS) are silently ignored, resulting in the same Compound Device Identifier (CDI) and key material as if no USS was provided. This occurs due to a buffer index error that overwrites the USS-enabled boolean with the first byte of the USS digest, effectively discarding any USS whose hash begins with 0x00. The LoadApp() function calls the internal loadApp() function, which contains the vulnerable code. The issue affects all client applications utilizing the tkeyclient Go module. Recommendations Upgrade to version 1.3.0. For users unable to upgrade immediately, switch to a USS whose hash does not begin with a zero byte.

Exploit

Fix

Weakness Enumeration

CWE-303

Related Identifiers

CVE-2026-32953

GHSA-4W7R-3222-8H6V

GO-2026-4728

SUSE-SU-2026:1135-1

Affected Products

Tillitis Tkey Client

Tkeyclient

References · 155

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32953.json · Exploit
• https://github.com/tillitis/tkeyclient/commit/4954dccf0287657edf8d405057e134cdff9c59e8 · Patch
• https://github.com/tillitis/tkeyclient/security/advisories/GHSA-4w7r-3222-8h6v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32953 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-32953 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32953 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-32953 · Security Note
• https://osv.dev/vulnerability/GO-2026-4728 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32953 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4w7r-3222-8h6v · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32953 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-32953 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://github.com/tillitis/tkeyclient/releases/tag/v1.3.0 · Note
• https://github.com/tillitis/tkeyclient · Note