CVE-2023-45128

Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulnerability can allow an attacker to inject arbitrary values without any authentication, or perform various malicious actions on behalf of an authenticated user, potentially compromising the security and integrity of the application. The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. This issue has been addressed in version 2.50.0 and users are advised to upgrade. Users should take additional security measures like captchas or Two-Factor Authentication (2FA) and set Session cookies with SameSite=Lax or SameSite=Secure, and the Secure and HttpOnly attributes as defense in depth measures. There are no known workarounds for this vulnerability.

• CWE-20
• CWE-352
• CWE-565
• CWE-807

• https://github.com/gofiber/fiber/commit/8c3916dbf4ad2ed427d02c6eb63ae8b2fa8f019aPatch
• https://github.com/gofiber/fiber/security/advisories/GHSA-94w9-97p3-p368Mitigation, Vendor Advisory
• https://github.com/gofiber/fiber/commit/8c3916dbf4ad2ed427d02c6eb63ae8b2fa8f019aPatch
• https://github.com/gofiber/fiber/security/advisories/GHSA-94w9-97p3-p368Mitigation, Vendor Advisory

Published

Oct 16, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-45122Rejected reason: It is a duplicate.
• CVE-2023-45123Rejected reason: It is a duplicate.
• CVE-2023-45124Rejected reason: It is a duplicate.
• CVE-2023-45125Rejected reason: It is a duplicate.
• CVE-2023-45126Rejected reason: It is a duplicate.
• CVE-2023-45127Rejected reason: It is a duplicate.
• CVE-2023-45129Synapse is an open-source Matrix homeserver written and main…4.9
• CVE-2023-4513BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and…7.5
• CVE-2023-45130Frontier is Substrate's Ethereum compatibility layer. Prior …7.5
• CVE-2023-45131Discourse is an open source platform for community discussio…7.5
• CVE-2023-45132NAXSI is an open-source maintenance web application firewall…9.8
• CVE-2023-45133Babel is a compiler for writingJavaScript. In `@babel/traver…8.8