packages:
  - module: github.com/ecnepsnai/web
    symbols:
      - Server.socketHandler
    derived_symbols:
      - Server.Socket
    versions:
      - introduced: 1.4.0
        fixed: 1.5.2
    vulnerable_at: 1.5.1
description: |
    The AuthenticateMethod authentication hook is not called for WebSocket
    connections, allowing unauthenticated access.

    This issue only affects WebSockets with an AuthenticateMethod hook.
    Request handlers that do not explicitly use WebSockets are not
    vulnerable.
cve_metadata:
    id: CVE-2021-4237
    cwe: "CWE 287: Improper Authentication"
ghsas:
  - GHSA-5gjg-jgh4-gppm
links:
    commit: https://github.com/ecnepsnai/web/commit/5a78f8d5c41ce60dcf9f61aaf47a7a8dc3e0002f