4.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32953

CVE-2026-32953: Tillitis: TKey Client has an Error in Protocol Implementation

Tillitis TKey Client package is a Go package for a TKey client. Versions 1.2.0 and below contain a critical bug in the tkeyclient Go module which causes 1 out of every 256 User Supplied Secrets (USS) to be silently ignored, producing the same Compound Device Identifier (CDI)—and thus the same key material—as if no USS is provided. This happens because a buffer index error overwrites the USS-enabled boolean with the first byte of the USS digest, so any USS whose hash starts with 0x00 is effectively discarded. This issue has been fixed in version 1.3.0. Users unable to upgrade immediately should switch to a USS whose hash does not begin with a zero byte.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32953

CVE-2026-32953:

4.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/tillitis/tkeyclient	go	< 1.3.0	1.3.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is caused by an off-by-one error in the tkeyclient.go file within the internal loadApp function. When constructing the data frame to send to the TKey hardware, the code sets a boolean flag at index 6 of a byte array (tx[6] = 1) to indicate that a User Supplied Secret (USS) is included. However, it then copies the 32-byte hash of the USS starting at the same index (copy(tx[6:], uss[:])), causing the first byte of the hash to overwrite the flag. If the first byte of the USS hash happens to be zero (a 1 in 256 chance), the flag is overwritten to 0, and the TKey device proceeds as if no USS was provided. This leads to the generation of a predictable Compound Device Identifier (CDI), undermining the security purpose of the USS. The patch corrects the destination index for the copy operation from 6 to 7, ensuring the flag is not overwritten. The primary user-facing functions that trigger this vulnerable logic are LoadApp and its wrapper LoadAppFromFile.

Vulnerable functions

TillitisKey.loadApp

tkeyclient.go

The vulnerability lies in this function where the User Supplied Secret (USS) digest is copied into the transmit buffer. The line `copy(tx[6:], uss[:])` uses an incorrect starting index of 6. This causes the first byte of the USS digest to overwrite the boolean flag at `tx[6]` which indicates whether a USS is being provided. If the first byte of the USS digest is 0, the flag is set to false, and the TKey device ignores the provided USS.

TillitisKey.LoadApp

tkeyclient.go

This is the primary exported function that client applications use to load a device application with a User Supplied Secret. It directly calls the vulnerable internal function `loadApp`, passing the user's secret phrase. Therefore, any call to this function with a secret phrase could trigger the vulnerability.

TillitisKey.LoadAppFromFile

tkeyclient.go

This function is a convenience wrapper that reads a device application from a file and then calls `TillitisKey.LoadApp` to load it onto the TKey. As it directly calls the vulnerable `LoadApp` function, it serves as another entry point for the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.