-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the use of predictable identifiers (xid) for OpenID Connect session cookies. The commit fixes this by replacing xid with cryptographically secure random strings. The primary vulnerable code was in oidc.go's handleOIDCRedirect, where cookies were generated via xid.New().String(). The newOIDCPendingAuth function also used xid-derived values for 'Nonce', though the CVE's main impact relates to cookies. The high confidence for handleOIDCRedirect aligns with the CVE's description, while the Nonce usage receives medium confidence as a secondary risk.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/drakkan/sftpgo/v2 | go | >= 2.3.0, < 2.6.4 | 2.6.4 |
GoGoOngoing coverage of React2Shell