{"id":"CVE-2020-36569","aliases":["GHSA-hrm3-3xm6-x33h","GO-2020-0004"],"url":"https://o3.security/vulnerability/CVE-2020-36569","summary":"golang-nanoauth authentication bypass vulnerability","details":"Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe is called with an empty token.","published":"2022-12-27T22:15:11.857Z","modified":"2026-07-08T05:56:25.724887962Z","cvss":{"score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},"epss":{"score":0.00811,"percentile":0.53622,"asOf":"2026-08-11"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/nanobox-io/golang-nanoauth","fixedVersion":"0.0.0-20200131131040-063a3fb69896"}],"fix":{"url":"https://github.com/nanobox-io/golang-nanoauth/commit/063a3fb69896acf985759f0fe3851f15973993f3","label":"nanobox-io/golang-nanoauth@063a3fb"},"references":[{"type":"ADVISORY","url":"https://github.com/nanobox-io/golang-nanoauth/pull/5"},{"type":"ADVISORY","url":"https://pkg.go.dev/vuln/GO-2020-0004"},{"type":"FIX","url":"https://github.com/nanobox-io/golang-nanoauth/commit/063a3fb69896acf985759f0fe3851f15973993f3"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T05:56:25.724887962Z"}}