{"affected":[{"product":"n/a","source":"CNA: mitre","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"cveId":"CVE-2026-38601","cwes":[],"description":"A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via forged session cookies.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793726293260,"publishedAt":1793664000000,"references":[{"source":"CNA: mitre","tags":[],"url":"https://github.com/codeskyblue/gohttpserver"},{"source":"CNA: mitre","tags":[],"url":"https://github.com/codeskyblue/gohttpserver/issues/232"},{"source":"CNA: mitre","tags":[],"url":"https://github.com/Den-Sec/security-research/blob/master/advisories/gohttpserver/VDR-002-hardcoded-secret.md"},{"source":"cve@mitre.org","tags":[],"url":"https://github.com/Den-Sec/security-research/blob/master/advisories/gohttpserver/VDR-002-hardcoded-secret.md"},{"source":"cve@mitre.org","tags":[],"url":"https://github.com/codeskyblue/gohttpserver"},{"source":"cve@mitre.org","tags":[],"url":"https://github.com/codeskyblue/gohttpserver/issues/232"}],"remediation":[],"revision":"e1de8bd2ce2f6637ae97bf6e1af8369859938c1bb7b6cc71d62f198dcc3f7d6a","sources":[{"modifiedAt":1793725094545,"name":"CNA: mitre","retrievedAt":1793725946572,"url":"https://www.cve.org/CVERecord?id=CVE-2026-38601"},{"modifiedAt":1793726293260,"name":"NVD","retrievedAt":1793730115198,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-38601"}],"ssvc":null,"status":"published","title":"CVE-2026-38601","updatedAt":1793730115198}