-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe commit diff shows critical authentication logic was added to socketHandler in websocket.go. The vulnerability existed because: 1) Pre-patch code lacked any call to options.AuthenticateMethod 2) UserData field was being passed to endpoints without validation 3) The nil UserData could cause crashes if dereferenced 4) Missing authentication enabled resource exhaustion via unauthorized WebSocket connections. The function's responsibility for WebSocket handshake handling and the explicit addition of authentication checks in the patch confirm this as the vulnerable entry point.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/ecnepsnai/web | go | >= 1.4.0, < 1.5.2 | 1.5.2 |