CVE-2026-38601
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 03, 2026
Vendor
unknown
Description
A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via forged session cookies.