Question 1

What is CVE-2026-38601 — CVE-2026-38601?

Accepted Answer

A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via forged session cookies.

Question 2

What is the authoritative source for CVE-2026-38601?

Accepted Answer

CVE-2026-38601 (CVE-2026-38601) is catalogued in NVD + CISA KEV + FIRST EPSS and curated for EU compliance use cases by SQUR.

CVE-2026-38601CVE-2026-38601

Description

Scoring