{"id":"CVE-2026-38601","kind":"vulnerability","aliases":["CVE-2026-38601"],"related":[],"title":"gohttpserver: hardcoded session key lets attackers forge login cookies","description":"A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via forged session cookies.","summary":"The gohttpserver file server ships with a hardcoded session secret key in versions through 1.3.0. An attacker can forge session cookies to impersonate any user and bypass OpenID Connect login.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"codeskyblue/gohttpserver","fixed":[],"affected":"<= 1.3.0","ecosystem":"go"}],"ecosystems":[],"tags":["go","gohttpserver","openid","package","self-hosted"],"not_affected_if":["auth-required-upstream","no-openid-login","unknown"],"how_to_check":"Run gohttpserver (any version up to 1.3.0, including the codeskyblue/gohttpserver Docker image) with OpenID login enabled? You are exposed. The source in openid-login.go builds the cookie store with the fixed string \"something-very-secret\", so there is no setting to change it in released versions. Check your start flags for the OpenID login option. Also check for a build from master that includes PR #233.","fix":"No released fix: 1.3.0 is the latest release. Open PR #233 (unmerged when last seen) reads the session secret from GHS_SESSION_SECRET and falls back to a random 32-byte key.","status":"open","published_at":"2026-11-03T17:18:13+00:00","first_seen_at":"2026-11-03T17:21:57+00:00","triaged_at":"2026-11-03T17:24:46+00:00","updated_at":"2026-11-03T17:26:12+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T17:24:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"gohttpserver: hardcoded session key lets attackers forge login cookies","impact":"high","summary":"The gohttpserver file server ships with a hardcoded session secret key in versions through 1.3.0. An attacker can forge session cookies to impersonate any user and bypass OpenID Connect login.","audience":"businesses","category":"package","nicknames":[],"who_cares":["gohttpserver","self-hosted","go"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker impersonates any user and controls the server","analyst_note":"Confirm fixed version and whether the session secret can be configured; check the NVD entry and the upstream gohttpserver repository.","how_to_check":"- Check the gohttpserver version in use; the sources name versions through `v1.3.0` as affected.\n- Look for OpenID Connect login enabled on the gohttpserver instance.\n- Confirm whether the session secret is set by configuration or left at the built-in value; the sources do not say how to check this.","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running codeskyblue gohttpserver through version 1.3.0, especially where OpenID Connect authentication protects access to controls. The sources do not say whether a configuration option overrides the hardcoded key, so exposure beyond the default build is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000676,"input_tokens":4095,"output_tokens":532,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm fixed version and whether the session secret can be configured; check the NVD entry and the upstream gohttpserver repository.","search":"'-2026':11A,14A '-38601':12A,15A '1.3.0':38B 'access':75C 'allow':64C 'attack':6A,40B,65C 'authent':73C 'bypass':50B,70C 'codeskyblu':60C 'codeskyblue/gohttpserver':16A 'connect':52B,72C 'control':77C 'cooki':9A,44B,81C 'cve':10A,13A 'file':26B 'forg':7A,42B,79C 'go':17B 'gohttpserv':1A,18B,25B,61C 'hardcod':2A,31B,55C 'host':23B 'imperson':46B,67C 'key':4A,34B,58C 'let':5A 'login':8A,53B 'openid':19B,51B,71C 'packag':20B 'secret':33B,57C 'self':22B 'self-host':21B 'server':27B 'session':3A,32B,43B,56C,80C 'ship':28B 'user':48B,69C 'v1.3.0':63C 'version':36B 'via':78C","nicknames":[],"mitigations":[],"who_affected":"Anyone running gohttpserver 1.3.0 or earlier with OpenID login enabled. The session cookie store is signed with a hardcoded key published in the source, so an attacker can forge a ghs-session cookie and impersonate a user, which can include upload or delete rights tied to a user's email in .ghs.yml. Instances that use no login or only HTTP basic auth do not rely on the cookie for login and can mostly skip this, though the cookie store is shared by the access checks.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["codeskybluegohttpserver"],"ptokens":["codeskyblue","gohttpserver"],"labels":["go","gohttpserver","high","openid","package","selfhosted"],"first_public_at":"2026-11-03T17:18:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-38601","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-38601","severity":null,"published_at":"2026-11-03T17:18:13+00:00","modified_at":"2026-11-03T17:18:13+00:00","first_seen_at":"2026-11-03T17:21:57+00:00","fetched_at":"2026-11-03T17:21:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-38601:1513","url":null,"severity":null,"published_at":"2026-11-03T17:26:12+00:00","modified_at":"2026-11-03T17:26:12+00:00","first_seen_at":"2026-11-03T17:26:12+00:00","fetched_at":"2026-11-03T17:26:12+00:00","note":"Read openid-login.go on master (hardcoded key) and open PR #233 (configurable GHS_SESSION_SECRET). NVD page not retrievable. No release past 1.3.0; project looks unmaintained. Not marked verified: no maintainer advisory. Sibling CVE-2026-38600 is the zip slip in the same PR."}],"documents":[{"id":59271,"url":"https://github.com/codeskyblue/gohttpserver/blob/master/openid-login.go","title":"gohttpserver openid-login.go (master)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":59272,"url":"https://github.com/codeskyblue/gohttpserver/pull/233","title":"PR #233: Zip Slip protection in unzipFile (open, unmerged)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":59273,"url":"https://github.com/codeskyblue/gohttpserver/releases","title":"gohttpserver releases (latest 1.3.0)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}