x/vulndb: potential Go vuln in github.com/komari-monitor/komari: GHSA-hxjg-93wc-h8p8

[GoVulnBot]

Advisory GHSA-hxjg-93wc-h8p8 references a vulnerability in the following Go modules:

Module
github.com/komari-monitor/komari

Description:

Vulnerability Overview

The session_token cookie is set without the SameSite or Secure attributes (login.go:68).

All /api/admin/ management endpoints rely solely on this cookie for authentication, with no CSRF token or Origin validation.

The server-side vulnerability is confirmed to exist; however, exploitation via cross-site requests is mitigated in modern browsers by the default SameSite=Lax behavior.

Root Cause

// komari-main/api/public/login.go:68
c.SetCookie("session_token", session, 2592000, "/", "", false, true)
//   Secure=false, SameSite not expl...

References:
- ADVISORY: https://github.com/advisories/GHSA-hxjg-93wc-h8p8
- ADVISORY: https://github.com/komari-monitor/komari/security/advisories/GHSA-hxjg-93wc-h8p8
- WEB: https://github.com/komari-monitor/komari/releases/tag/1.2.2

Cross references:
- github.com/komari-monitor/komari appears in 2 other report(s):
  - data/reports/GO-2025-3873.yaml    (https://github.com/golang/vulndb/issues/3873)
  - data/reports/GO-2025-3874.yaml    (https://github.com/golang/vulndb/issues/3874)

See [doc/quickstart.md](https://github.com/golang/vulndb/blob/master/doc/quickstart.md) for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
- module: github.com/komari-monitor/komari
versions:
- fixed: 0.0.0-20260609084633-98122fa4d110
summary: 'Komari: Management Interface CSRF in github.com/komari-monitor/komari'
ghsas:
- GHSA-hxjg-93wc-h8p8
references:
- advisory: GHSA-hxjg-93wc-h8p8
- advisory: GHSA-hxjg-93wc-h8p8
- web: https://github.com/komari-monitor/komari/releases/tag/1.2.2
notes:
- fix: 'github.com/komari-monitor/komari: could not add vulnerable_at: cannot auto-guess when fixed version is 0.0.0 pseudo-version'
source:
id: GHSA-hxjg-93wc-h8p8
created: 2026-09-10T00:01:54.697442192Z
review_status: UNREVIEWED