SFTP authentication bypass in goshs via empty-username basic-auth (CVE-2026-40884)

goshs contains an authentication bypass in its SFTP service triggered when the server is started with the documented empty-username basic-auth syntax (`-b ':pass'`). Because the SFTP password handler is only installed when both username and password are non-empty strings, supplying an empty username causes the handler to be skipped entirely, leaving the SFTP service unauthenticated. An unauthenticated network attacker can then read, upload, rename, and delete files within the configured SFTP root without providing any credentials. Affected versions: - <= v2.0.0-beta.5 We recommend updating to: v2.0.0-beta.6. CVSS 9.8 · our assessment: act_now Reference: https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv Details: https://vuln.today/cve/CVE-2026-40884