---
id: CVE-2026-38601
title: >-
  A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0
  allows attackers to impersonate any user, bypass OpenID Connect authentication
  and access all controls via forged session cookies.
summary: >-
  A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0
  allows attackers to impersonate any user, bypass OpenID Connect authentication
  and access all controls via forged session cookies.
severity: none
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T16:58:14.545Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-38601'
references:
  - url: 'https://github.com/codeskyblue/gohttpserver'
  - url: 'https://github.com/codeskyblue/gohttpserver/issues/232'
  - url: >-
      https://github.com/Den-Sec/security-research/blob/master/advisories/gohttpserver/VDR-002-hardcoded-secret.md
tags:
  - cve.org
epss: 0.002
epssPercentile: 0.09963
ingestedAt: '2026-11-05T20:33:06.294Z'
---

## Overview

A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via forged session cookies.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.