—
GO-2025-4018
Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret in github.com/ossf/allstar
Quick fix
GO-2025-4018 — github.com/ossf/allstar: upgrade to the fixed version with the command below.
go get github.com/ossf/allstar@v0.0.0-20250721181116-e004ecb540d6Details
Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret in github.com/ossf/allstar
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/ossf/allstar
Introduced in:
0Fixed in: 0.0.0-20250721181116-e004ecb540d6Fix
go get github.com/ossf/allstar@v0.0.0-20250721181116-e004ecb540d6References
- https://github.com/ossf/allstar/security/advisories/GHSA-33f4-mjch-7fpr[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2025-61926[ADVISORY]
- https://github.com/ossf/allstar/commit/e004ecb540d63ca6f5b1689b41af6c0040a82c73[FIX]
- https://github.com/ossf/allstar/pull/713[FIX]
- https://github.com/ossf/allstar/blob/294ae985cc2facd0918e8d820e4196021aa0b914/pkg/reviewbot/reviewbot.go#L59[WEB]