CVE-2021-41615

websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the secret-data guideline for HTTP Digest Access Authentication in RFC 7616 section 3.3 (or RFC 2617 section 3.2.1). NOTE: 2.1.8 is a version from 2003; however, the affected websda.c code appears in multiple derivative works that may be used in 2021. Recent GoAhead software is unaffected.

• CWE-331

• https://devel.rtems.org/browser/rtems/cpukit/httpd/websda.c?rev=c1427d2758079f0e9dd6a8de1662d78e0d6bc4caMailing List, Third Party Advisory
• https://github.com/trenta3/goahead-versions/blob/master/2.1.8/230165webs218.tar.gz?raw=trueProduct, Third Party Advisory
• https://devel.rtems.org/browser/rtems/cpukit/httpd/websda.c?rev=c1427d2758079f0e9dd6a8de1662d78e0d6bc4caMailing List, Third Party Advisory
• https://github.com/trenta3/goahead-versions/blob/master/2.1.8/230165webs218.tar.gz?raw=trueProduct, Third Party Advisory

Published

Aug 8, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-4161The affected products contain vulnerable firmware, which cou…7.5
• CVE-2021-41610Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-41611An issue was discovered in Squid 5.0.6 through 5.1.x before …7.5
• CVE-2021-41612An issue was discovered in the ALU unit of the OpenRISC mor1…8.8
• CVE-2021-41613An issue was discovered in the controller unit of the OpenRI…4.3
• CVE-2021-41614An issue was discovered in the controller unit of the OpenRI…7.8
• CVE-2021-41616Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that w…9.8
• CVE-2021-41617sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non…7
• CVE-2021-41619An issue was discovered in Gradle Enterprise before 2021.1.2…7.2
• CVE-2021-4162archivy is vulnerable to Cross-Site Request Forgery (CSRF)4.3
• CVE-2021-41634A user enumeration vulnerability in MELAG FTP Server 2.2.0.4…5.3
• CVE-2021-41635When installed as Windows service MELAG FTP Server 2.2.0.4 i…8.8