CVE-2026-38601

EUVD-2026-116105
A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via forged session cookies.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
References
https://github.com/Den-Sec/security-research/blob/master/advisories/gohttpserver/VDR-002-hardcoded-secret.md
https://github.com/codeskyblue/gohttpserver
https://github.com/codeskyblue/gohttpserver/issues/232