packages:
  - module: github.com/ecnepsnai/web
    symbols:
      - Server.socketHandler
    derived_symbols:
      - Server.Socket
    versions:
      - introduced: 1.4.0
        fixed: 1.5.2
    vulnerable_at: 1.5.1
description: |
    The AuthenticateMethod authentication hook is not called for WebSocket
    connections, allowing unauthenticated access.

    This issue only affects WebSockets with an AuthenticateMethod hook.
    Request handlers that do not explicitly use WebSockets are not
    vulnerable.
ghsas:
  - GHSA-5gjg-jgh4-gppm
links:
    commit: https://github.com/ecnepsnai/web/commit/5a78f8d5c41ce60dcf9f61aaf47a7a8dc3e0002f