CVE-2026-38601
Received Received - Intake

Hardcoded Session Secret Key in gohttpserver Authentication Bypass

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: MITRE

Description
A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via forged session cookies.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-38601
EUVD
EUVD-2026-116105

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-38601 is a vulnerability in gohttpserver versions up to v1.3.0 where a hardcoded session secret key is used to sign session cookies. This secret is identical across all installations and publicly visible in the source code, allowing attackers to forge valid session cookies and impersonate any user listed in the ACL file.

Detection Guidance

Check if gohttpserver version is v1.3.0 or earlier by running: go list -m github.com/codeskyblue/gohttpserver@v1.3.0. Inspect the source code for hardcoded secret 'something-very-secret' in openid-login.go line 18. Verify session cookies can be forged by testing authentication bypass with crafted cookies.

Impact Analysis

This vulnerability allows remote attackers to bypass authentication and perform privileged actions like uploading or deleting files. It can lead to authentication forgery and privilege escalation, potentially enabling further attacks such as Zip Slip if combined with other vulnerabilities.

Mitigation Strategies

Upgrade to a patched version if available or apply PR #233. Disable the --upload flag if enabled. Regenerate session secrets with random values instead of hardcoded keys. Restrict server exposure to trusted networks only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-38601. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...