CVE-2026-38601: Security vulnerability

Published Nov 3, 2026

Updated

A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via forged session cookies.

Event History

Nov 3, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·05:18 PM

Description

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to forge session cookies using the hardcoded session secret key. Successful exploitation allows impersonation of any user and bypass of OpenID Connect authentication.

Are deployments using OpenID Connect protected from this vulnerability?

No. The issue explicitly allows attackers to bypass OpenID Connect authentication through forged session cookies.

What level of access can a successful attacker obtain?

A successful attacker can impersonate any user and access all controls.

CVE-2026-38601: Security vulnerability

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Are deployments using OpenID Connect protected from this vulnerability?

What level of access can a successful attacker obtain?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Are deployments using OpenID Connect protected from this vulnerability?

What level of access can a successful attacker obtain?