CVE-2025-66630
CRITICAL
GHSA-68rr-p4fp-j59v
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Lifecycle Timeline
3Description
Fiber is an Express inspired web framework written in Go. Before 2.52.11, on Go versions prior to 1.24, the underlying crypto/rand implementation can return an error if secure randomness cannot be obtained. Because no error is returned by the Fiber v2 UUID functions, application code may unknowingly rely on predictable, repeated, or low-entropy identifiers in security-critical pathways. This is especially impactful because many Fiber v2 middleware components (session middleware, CSRF, rate limiting, request-ID generation, etc.) default to using utils.UUIDv4(). This vulnerability is fixed in 2.52.11.
Analysis
Go Fiber web framework before 2.52.11 has a weak PRNG vulnerability (on Go < 1.24) that makes session tokens predictable, enabling session hijacking.
Technical Context
Fiber < 2.52.11 uses a CWE-338 cryptographically weak PRNG for session token generation on Go versions prior to 1.24, making tokens predictable.
Affected Products
['Go Fiber < 2.52.11 (on Go < 1.24)']
Remediation
Update Fiber to 2.52.11+ or use Go 1.24+.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today