Forge: AES-GCM authentication bypass via unvalidated tagLength option

Summary The AES-GCM mode in forge.cipher does not validate the tagLength option passed to start. With a tagLength of 0 or a value that converts to 0 such as null, false, '' or '0', the authentication tag is empty, and decipher.finish returns true for any ciphertext and additional data when the...