https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 07:39:08 +0000 https://cve.radiocsirt.org/vuln/cve-2026-24058 <p><strong>Affected:</strong> charmbracelet soft-serve</p> <p>Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication bypass vulnerability that allows an attacker to impersonate any user (including admin) by &#34;offering&#34; the victim&#39;s public key during the SSH handshake before authenticating with their own valid key. This occurs because the user identity is stored in the session context during the &#34;offer&#34; phase and is not cleared if that specific authentication attempt fails. This issue has been fixed in version 0.11.3.</p> <p><strong>Affected:</strong> charmbracelet soft-serve</p> <p>Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication bypass vulnerability that allows an attacker to impersonate any user (including admin) by &#34;offering&#34; the victim&#39;s public key during the SSH handshake before authenticating with their own valid key. This occurs because the user identity is stored in the session context during the &#34;offer&#34; phase and is not cleared if that specific authentication attempt fails. This issue has been fixed in version 0.11.3.</p> https://cve.radiocsirt.org/vuln/cve-2026-24058