SFTP Authentication Bypass in goshs by Patrick Hener
CVE-2026-40884

9.8CRITICAL

Key Information:

Vendor

Patrickhener

Status
Goshs
Vendor
CVE Published:
21 April 2026

What is CVE-2026-40884?

The goshs SimpleHTTPServer, created by Patrick Hener, is vulnerable to an SFTP authentication bypass. In versions prior to 2.0.0-beta.6, the server permits the use of an empty username in the basic-auth syntax. When configured with the -b ':pass' option and -sftp, it does not initiate a password handler for SFTP, allowing unauthorized network access to files stored on the server. This poses a significant risk for sensitive data exposure. Users are urged to upgrade to version 2.0.0-beta.6 or later to mitigate this vulnerability.

Affected Version(s)

goshs < 2.0.0-beta.6

References

https://github.com/patrickhener/goshs/security/advisories...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.