Skip to content
OpenAdvisories
Critical · 9.8 CVE-2021-4236 EUVD-2022-7668GHSA-5gjg-jgh4-gppmGHSA-jpgg-cp2x-qrw3GO-2021-0107

Panic or authentication bypass in github.com/ecnepsnai/web

Published Dec 27, 2022 · Updated Apr 11, 2025 · Assigned by Go

Description

Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not explicitly use WebSockets are not vulnerable.

Affected products

VendorProductAffectedFixed
github.com/ecnepsnai/web github.com/ecnepsnai/web 1.4.0 – < 1.5.2 1.5.2

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/ecnepsnai/web >= 1.4.0, < 1.5.2 1.5.2 GHSA-5gjg-jgh4-gppm

References