gohttpserver hardcoded session key allows user impersonation

Anyone can pose as a user on this file web server.

Summary

A hardcoded session signing key in codeskyblue gohttpserver lets attackers impersonate any user and bypass OpenID Connect login with forged session cookies. Versions through v1.3.0 are affected.

What to do

Check that you run a version newer than v1.3.0 and read the vendor's advisory; the sources name no fixed version.

Products and platforms

Windows
macOS
Linux
codeskyblue gohttpserver

CVE IDs

CVE-2026-38601 (opens in a new tab)

Sources

Write-up: github.com (opens in a new tab)

Times

First published 2026-11-03 00:00 UTC

First seen 2026-11-09 14:50 UTC