CVE-2023-32691

gost (GO Simple Tunnel) is a simple tunnel written in golang. Sensitive secrets such as passwords, token and API keys should be compared only using a constant-time comparison function. Untrusted input, sourced from a HTTP header, is compared directly with a secret. Since this comparison is not secure, an attacker can mount a side-channel timing attack to guess the password. As a workaround, this can be easily fixed using a constant time comparing function such as `crypto/subtle`'s `ConstantTimeCompare`.

• CWE-203
• CWE-203

• https://github.com/ginuerzh/gost/blob/1c62376e0880e4094bd3731e06bd4f7842638f6a/auth.go#L46Product
• https://github.com/ginuerzh/gost/security/advisories/GHSA-qjrq-hm79-49wwExploit, Vendor Advisory
• https://github.com/ginuerzh/gost/blob/1c62376e0880e4094bd3731e06bd4f7842638f6a/auth.go#L46Product
• https://github.com/ginuerzh/gost/security/advisories/GHSA-qjrq-hm79-49wwExploit, Vendor Advisory

Published

May 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-32686Kiwi TCMS is an open source test management system for both …5.4
• CVE-2023-32687tgstation-server is a toolset to manage production BYOND ser…6.5
• CVE-2023-32688parse-server-push-adapter is the official Push Notification …7.5
• CVE-2023-32689Parse Server is an open source backend that can be deployed …6.5
• CVE-2023-3269A vulnerability exists in the memory management subsystem of…7.8
• CVE-2023-32690libspdm is a sample implementation that follows the DMTF SPD…7.5
• CVE-2023-32692CodeIgniter is a PHP full-stack web framework. This vulnerab…9.8
• CVE-2023-32693Decidim is a participatory democracy framework, written in R…6.1
• CVE-2023-32694Saleor Core is a composable, headless commerce API. Saleor's…5.4
• CVE-2023-32695socket.io parser is a socket.io encoder and decoder written …7.5
• CVE-2023-32696CKAN is an open-source data management system for powering d…8.8
• CVE-2023-32697SQLite JDBC is a library for accessing and creating SQLite d…9.8