{"affected":[{"defaultStatus":"unaffected","ecosystem":"github","packageName":"tink-crypto/tink-go","product":"tink-go","source":"CNA: VulnCheck","vendor":"tink-crypto","versions":[{"lessThanOrEqual":"2.8.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-109425","cwes":["CWE-1286"],"description":"Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural Validate() step before constructing a keyset.Handle, allowing malformed public or no-secret keysets that violate Tink's keyset invariants to be accepted. Attackers can supply a malformed keyset, such as one with an enabled public key lacking a valid primary key or a DESTROYED key with no KeyData, causing inconsistent downstream validation where functions like jwt.JWKSetFromPublicKeysetHandle() process the invalid handle and produce a JWK set, potentially misleading applications that rely on successful handle construction as proof of keyset integrity.","epss":{"date":"2026-11-08","percentile":0.08992,"score":0.00193},"exploits":[{"kind":"exploit","source":"CNA: VulnCheck","url":"https://github.com/tink-crypto/tink-go/issues/68"}],"kev":null,"metrics":[{"score":6.9,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":5.3,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1794146448625,"publishedAt":1791834937215,"references":[{"source":"CNA: VulnCheck","tags":["technical-description","exploit","issue-tracking"],"url":"https://github.com/tink-crypto/tink-go/issues/68"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/tink-go-keyset-validation-bypass-via-newhandlewithnosecrets"}],"remediation":[],"revision":"54d04b4bb86d270b1f4799c0306fc9e2465196a50471004e5795a86315d73442","sources":[{"modifiedAt":1794146448625,"name":"CNA: VulnCheck","retrievedAt":1794147014386,"url":"https://www.cve.org/CVERecord?id=CVE-2026-109425"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794150616607,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109425"}],"ssvc":{"assessedAt":1791903817680,"automatable":"yes","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Tink-go 2.8.0 Keyset Validation Bypass via NewHandleWithNoSecrets","updatedAt":1794150616607}