CVE-2026-38601

Full vulnerability record from the local CVENow database.

Description

A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via forged session cookies.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-03 17:18:13.260000

Last modified

2026-11-03 17:18:13.260000

View original CVE JSON

{
  "id": "CVE-2026-38601",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-03T17:18:13.260",
  "lastModified": "2026-11-03T17:18:13.260",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via forged session cookies."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://github.com/Den-Sec/security-research/blob/master/advisories/gohttpserver/VDR-002-hardcoded-secret.md",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/codeskyblue/gohttpserver",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/codeskyblue/gohttpserver/issues/232",
      "source": "[email protected]"
    }
  ]
}