title: Authentication bypass in github.com/nanobox-io/golang-nanoauth
description: Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe is called with an empty token.
problem types: CWE-305: Authentication Bypass by Primary Weakness
affected:
{
vendor: github.com/nanobox-io/golang-nanoauth
product: github.com/nanobox-io/golang-nanoauth
collectionURL: https://pkg.go.dev
packageName: github.com/nanobox-io/golang-nanoauth
versions:
version: 0.0.0-20160722212129-ac0cc4484ad4, lessThan: 0.0.0-20200131131040-063a3fb69896, status: affected, versionType: semver
programRoutines:
name: Auth.ServeHTTP
name: Auth.ListenAndServeTLS
name: Auth.ListenAndServe
name: ListenAndServe
name: ListenAndServeTLS
defaultStatus: unaffected
}