Critical UUID Flaw in Fiber v2 Framework Enables Session Hijacking

#cybersecurity #infosec

Summary

Fiber v2 patched a critical vulnerability (CVE-2025-66630) that generates predictable all-zero UUIDs when secure randomness fails, enabling session hijacking and CSRF bypass.

Take Action:

If you are running applications running Fiber v2, prioritize updating to version 2.52.11 and update environments to Go 1.24, This is a weird flaw that may not happen regularly and is hard to reproduce, but it will hit you if you leave the old version long enough. It's better to patch than to hope.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines