CVE-2026-38601

The codeskyblue gohttpserver (through version v1.3.0 ) contains a hardcoded session secret key . This vulnerability allows an attacker to forge session cookies, leading to the ability to impersonate any user , bypass OpenID Connect authentication , and gain access to all controls. No specific rem...