CVE-2026-38601

Unrated

Published 2026-11-03 · last changed 2026-11-03

The fix

We hold no Microsoft remediation data for CVE-2026-38601, which normally means it is not a Windows CVE. For non-Microsoft software the fix is the vendor's own updated release, and the affected versions are listed below.

What it is

A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via forged session cookies.

Sources

NVD record for CVE-2026-38601