What’s Vulnerable › Vulnerabilities

CVE-2020-36569: Authentication bypass in github.com/nanobox-io/golang-nanoauth

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-12-27 · updated 2026-06-17
• Weakness: CWE-287

Description

Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe is called with an empty token.

Affected products

• github.com/nanobox-io/golang-nanoauth: from 2016-07-22 through 2020-01-31

References

• https://github.com/nanobox-io/golang-nanoauth/commit/063a3fb69896acf985759f0fe3851f15973993f3
• https://github.com/nanobox-io/golang-nanoauth/pull/5
• https://pkg.go.dev/vuln/GO-2020-0004
• https://github.com/nanobox-io/golang-nanoauth/commit/063a3fb69896acf985759f0fe3851f15973993f3
• https://github.com/nanobox-io/golang-nanoauth/pull/5
• https://pkg.go.dev/vuln/GO-2020-0004

Get alerted when CVE-2020-36569 or the next vulnerability affects your stack