golang-nanoauth authentication bypass vulnerability

CRITICAL 9.1CVE-2020-36569 · GHSA-hrm3-3xm6-x33h · GO-2020-0004 · Published 27/12/2022 · updated 17/06/2026

In short

CVE-2020-36569 is a CRITICAL (CVSS 9.1) vulnerability affecting github.com/nanobox-io/golang-nanoauth, golang-nanoauth (digitalocean).
Chance of exploitation in the next 30 days (EPSS): 0.88%, higher than 59.1% of all vulnerabilities.
Fix: update to 0.0.0-20200131131040-063a3fb69896 or later.

Package	Affected versions	Patched versions
github.com/nanobox-io/golang-nanoauth Go	`≥ 0.0.0-20160722212129-ac0cc4484ad4, < 0.0.0-20200131131040-063a3fb69896`	`0.0.0-20200131131040-063a3fb69896`
golang-nanoauth digitalocean	`≥ 2016-07-22, ≤ 2020-01-31`	No fix yet

Description

Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe is called with an empty token.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2020-36569 · ADVISORY
nanobox-io/golang-nanoauth#5 · WEB
nanobox-io/golang-nanoauth commit 063a3fb · WEB
nanobox-io/golang-nanoauth · PACKAGE
pkg.go.dev/vuln/GO-2020-0004 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free