CVE-2026-32953

CVE-2026-32953 identifies a critical buffer index error in the Tillitis TKey Client package (tkeyclient Go module) versions 1.2.0 and below. This flaw causes 1 in 256 User Supplied Secrets (USS) to be silently ignored if its hash begins with 0x00, resulting in the generation of identical key material as if no USS was provided. Rated Medium with a CVSS score of 4.7, exploitation requires physical access (AV:P) but has low complexity (AC:L), potentially compromising security confidentiality, integrity, and availability (SC:H, SI:H, SA:H) by undermining the uniqueness of cryptographic keys. The vulnerability is fixed in version 1.3.0, with a workaround suggesting users switch to a USS whose hash does not begin with a zero byte. There is currently no evidence of active exploitation, public exploit code, or significant community discussion regarding this vulnerability.