Renewerner87

**Name of the Vulnerable Software and Affected Versions** GoFiber versions prior to 2.52.5 **Description** A session middleware issue in GoFiber versions 2 and above allows users to supply their own `session id` value, resulting in the creation of a session with that key. If a website relies on the mere presence of a session for security purposes, this can lead to significant security risks, including unauthorized access and session fixation attacks. All users utilizing GoFiber's session middleware in the affected versions are impacted. **Recommendations** To mitigate this issue, users are strongly encouraged to upgrade to version 2.52.5 or higher. For users who are unable to upgrade immediately, either implement additional validation to ensure `session ids` are not supplied by the user and are securely generated by the server, or regularly rotate `session ids` and enforce strict session expiration policies.

**Name of the Vulnerable Software and Affected Versions** Fiber versions prior to 2.50.0 **Description** A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions being taken on the user's behalf, potentially compromising the security and integrity of the application. The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application, specifically due to the lack of token association with the original requestor. **Recommendations** For versions prior to 2.50.0, upgrade to version 2.50.0 or later to address the vulnerability. As a temporary workaround, consider implementing proper CSRF protection mechanisms, such as the Double Submit Cookie method or the Synchronizer Token Pattern using sessions. Additionally, users should take extra security measures like captchas or Two-Factor Authentication (2FA) and set Session cookies with SameSite=Lax or SameSite=Secure, and the Secure and HttpOnly attributes.