UNKNOWN NVD
CVE-2026-38601
A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and acc
A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via forged session cookies.
References
- https://github.com/Den-Sec/security-research/blob/master/advisories/gohttpserver/VDR-002-h
- https://github.com/codeskyblue/gohttpserver
- https://github.com/codeskyblue/gohttpserver/issues/232
This unknown severity vulnerability was published on 2026-11-03 via NVD.
vulnfeed aggregates 18261 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.