Description
Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not explicitly use WebSockets are not vulnerable.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| github.com/ecnepsnai/web | github.com/ecnepsnai/web | 1.4.0 – < 1.5.2 | 1.5.2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/ecnepsnai/web | >= 1.4.0, < 1.5.2 | 1.5.2 | GHSA-5gjg-jgh4-gppm |