UNKNOWNCVSS not yet scoredVulnerability
CVE-2026-38601
A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via forged session cookies.
Properties
- Last source
- NVD
- Nvd fetched at
- 2026-11-03T17:20:13.885968+00:00
- Cve id
- CVE-2026-38601
- First seen by Signal
- 2026-11-03T17:21:19+00:00
- Retrieved at
- 2026-11-03T17:21:19+00:00
- Published at
- 2026-11-03T17:18:13.260
- Last modified
- 2026-11-03T17:18:13.260
Explore deeper with Ninja Signal's threat intelligence graph