Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery by bit flipping
Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an attacker with write access to stored ciphertext to make it decrypt to a chosen value via bit flipping. Cloak.Ciphers.AES.CTR encrypts with AES-256 in CTR mode and stores the key tag, the IV and the ciphertext with no MAC. decrypt/2 checks only the key tag and the minimum length before it returns the plaintext, and Cloak.Ciphers.Deprecated.AES.CTR decrypts the legacy format the same way. CTR is a stream cipher, so a value XORed into the stored ciphertext is XORed into the plaintext at the same offset. An attacker who can write to the encrypted store (for example through SQL injection or a compromised replica) and who knows or can guess a stored plaintext can replace it with any value of the same length. The application receives that value with no error. This issue affects cloak: from 0.1.0-pre onward.
CVE-2026-95105
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-95105
cloak
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
cloak
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"cpes": [
"cpe:2.3:a:danielberkompas:cloak:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/danielberkompas/cloak",
"vendor": "danielberkompas",
"modules": [
"'Elixir.Cloak.Ciphers.AES.CTR'",
"'Elixir.Cloak.Ciphers.Deprecated.AES.CTR'"
],
"product": "cloak",
"versions": [
{
"status": "affected",
"version": "0.1.0-pre",
"lessThan": "*",
"versionType": "semver"
}
],
"packageURL": "pkg:hex/cloak",
"packageName": "cloak",
"programFiles": [
"lib/cloak/ciphers/aes_ctr.ex",
"lib/cloak/ciphers/deprecated/aes_ctr.ex"
],
"collectionURL": "https://repo.hex.pm",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "'Elixir.Cloak.Ciphers.AES.CTR':encrypt/2"
},
{
"name": "'Elixir.Cloak.Ciphers.AES.CTR':decrypt/2"
},
{
"name": "'Elixir.Cloak.Ciphers.Deprecated.AES.CTR':decrypt/2"
}
]
},
{
"cpes": [
"cpe:2.3:a:danielberkompas:cloak:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/danielberkompas/cloak",
"vendor": "danielberkompas",
"modules": [
"'Elixir.Cloak.Ciphers.AES.CTR'",
"'Elixir.Cloak.Ciphers.Deprecated.AES.CTR'"
],
"product": "cloak",
"versions": [
{
"status": "affected",
"version": "2bd17019e285b55c5c218cc842537bf9280f24c3",
"lessThan": "*",
"versionType": "git"
}
],
"packageURL": "pkg:github/danielberkompas/cloak",
"packageName": "danielberkompas/cloak",
"programFiles": [
"lib/cloak/ciphers/aes_ctr.ex",
"lib/cloak/ciphers/deprecated/aes_ctr.ex"
],
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "'Elixir.Cloak.Ciphers.AES.CTR':encrypt/2"
},
{
"name": "'Elixir.Cloak.Ciphers.AES.CTR':decrypt/2"
},
{
"name": "'Elixir.Cloak.Ciphers.Deprecated.AES.CTR':decrypt/2"
}
]
}
]- Related CVEs
- CVE-2026-95105
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #9204 · Revision 1
- Added to Heist Feed
- Publisher date