RUSTSEC-2026-0336: MIKEY message MAC is never verified on receive, so forged messages are accepted

What to do

1. See which version you have: cargo tree -i mykey (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p mykey. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example mykey = "2.0.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

mykey implements MIKEY (RFC 3830) for SRTP key exchange. No receive path verified the MIKEY message authentication code.

crypto::verify_mac existed and was correct, but it was called only from unit tests , neither MikeyMessage::from_bytes nor MikeyMessage::complete_psk invoked it.

new_psk_init computed an HMAC-SHA-1-160 over the serialized message and appended it, so the tag was present on the wire and looked like integrity protection. It was decorative: a receiver accepted any message regardless of whether the MAC was correct, wrong, or absent.

Consequences

• An attacker able to inject or modify MIKEY messages in transit faced no integrity check. Modified RAND, SSRC or security-policy payloads were accepted silently. Note that this does not require a man-in-the-middle position: since nothing was checked, a wholly forged PSK-Init was accepted.
• Pre-shared key mode therefore provided no mutual authentication, despite the documentation claiming that it did. Possession of the pre-shared key was never actually proven by either party.
• Replayed init messages were not rejected.

The practical severity was bounded by GHSA-fwjg-cm92-j3hj (cleartext TGK), which already let a passive observer recover the key material outright without needing to forge anything.

The fix

complete_psk now verifies the message MAC **before** any decryption, so a message that fails authentication yields no key material at all. A MacAlg::Null payload, an absent MAC and a truncated MAC are each refused rather than treated as "no check required".

The authentication key is now derived from the pre-shared key per RFC 3830 §4.1.4 rather than from the TGK , a prerequisite, since verifying against a TGK-derived key would have been circular while the TGK travelled in the message itself. Optional §6.9 verification messages were also added, giving the exchange genuine mutual authentication.

Replay protection is still absent: a captured PSK-Init can be replayed and will be accepted, because the optional COUNTER timestamp is emitted rather than a mandatory NTP type and no record of seen timestamps or RAND values is kept. That gap is tracked at <https://github.com/waxspin/mykey/issues/24> and is not covered by this advisory.

Workarounds

Treat parsed MIKEY messages as unauthenticated input: do not rely on pre-shared key mode for peer authentication or message integrity, and carry it over a transport that provides both.

References

• Package: crates.io/crates/mykey
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0336.html
• Web: github.com/waxspin/mykey/pull/25

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for mykey

• Vulnerability CriticalRUSTSEC-2026-0335 · 2026-10-09Pre-shared key mode transmits the TGK in cleartext, exposing the SRTP master key

Full security history of mykey