CVE-2026-38601 in gohttpserver
Summary
by MITRE • 11/03/2026
A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via forged session cookies.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in codeskyblue gohttpserver versions prior to 1.3.0 represents a critical failure in cryptographic key management that fundamentally undermines the integrity of the application's authentication mechanism. The core technical flaw lies in the use of a hardcoded, static secret key for signing session cookies. In secure web applications, session secrets must be unique per deployment and generated using a cryptographically secure random number generator to ensure unpredictability. By embedding this value directly into the source code or configuration as a constant, the system fails to provide any form of entropy protection against attackers who can access the binary or source repository. This static nature means that once an attacker obtains the secret key, which is trivial if they have read access to the project's version control history or decompiled binaries, they possess the mathematical capability to forge valid session tokens for any user account without needing their actual credentials.
From a technical perspective, this flaw allows for complete authentication bypass through cookie forgery. The application relies on these signed cookies to validate user identity and permissions during OpenID Connect flows. When an attacker generates a forged token using the known secret key, the server accepts it as legitimate because the cryptographic signature matches perfectly. This effectively nullifies the security guarantees provided by external identity providers such as Google, GitHub, or other OAuth2/OIDC services. The vulnerability is not limited to simple login bypass; it grants the attacker full administrative control over the compromised account's session state. Since gohttpserver often serves sensitive files and provides directory listing capabilities, this level of access allows an adversary to read, modify, upload, or delete arbitrary files on the server host depending on the privileges associated with the impersonated user identity.
The operational impact of this vulnerability is severe, particularly in environments where gohttpserver is used for internal file sharing or development purposes. An attacker can escalate their privilege from a guest role to an administrator by forging tokens for accounts that possess elevated permissions. This leads to unauthorized access to confidential data stored within the served directories and potential remote code execution if the server allows file uploads with executable extensions. Furthermore, because the vulnerability affects all users regardless of their actual authentication status, it compromises the confidentiality and integrity of the entire system. The persistence of this risk is high as long as the hardcoded key remains in use across different deployments, creating a single point of failure that can be exploited globally if the secret becomes public knowledge.
This issue aligns with CWE-798: Use of Hard-coded Credentials, which categorizes vulnerabilities where static authentication credentials are embedded within software code or configuration files. It also maps to MITRE ATT&CK technique T1078: Valid Accounts, specifically under the sub-technique of using forged tokens to impersonate legitimate users. To mitigate this risk, immediate remediation requires upgrading to version 1.3.0 or later where the hardcoded secret has been replaced with a dynamically generated one for each instance. For deployments that cannot be immediately upgraded, administrators should configure an environment variable or external configuration file to override the default session key at startup time, ensuring that every deployment uses a unique, high-entropy random string. Additionally, implementing strict access controls and monitoring for anomalous session activity can help detect exploitation attempts in legacy systems until they are patched.