Detections
Analytics

CVE-2020-36569

critical

Description

Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe is called with an empty token.

References

https://pkg.go.dev/vuln/GO-2020-0004

https://github.com/nanobox-io/golang-nanoauth/pull/5

https://github.com/nanobox-io/golang-nanoauth/commit/063a3fb69896acf985759f0fe3851f15973993f3

https://github.com/advisories/GHSA-hrm3-3xm6-x33h

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-7651

Details

Source: Mitre, NVD

Published: 2022-12-27

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 9.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

Severity: High

CVSS v3

Base Score: 9.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Severity: Critical

EPSS

EPSS: 0.0088