---
title: "GHSA-xv8g-fj9h-6gmv: Linkdave Missing Authentication on REST and WebSocket endpoints"
url: https://erroneo.us/security/ghsa/GHSA-xv8g-fj9h-6gmv/
description: "GHSA-xv8g-fj9h-6gmv (critical, Go): Linkdave Missing Authentication on REST and WebSocket endpoints. The linkdave server does not enforce authentication on…"
type: advisory
section: "Security Digest"
date_published: 2026-03-10
date_modified: 2026-03-10
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-xv8g-fj9h-6gmv"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-xv8g-fj9h-6gmv: Linkdave Missing Authentication on REST and WebSocket endpoints

## Affected packages

- Go `github.com/shi-gg/linkdave` < 0.1.5 → fixed: 0.1.5

## Details

The linkdave server does not enforce authentication on its REST and WebSocket routes in versions prior to 0.1.5. Impact An attacker with network access to the server port can: - Connect to the WebSocket endpoint (/ws) and receive a valid sessionid in the OpReady response. - Use that session to invoke all REST player controls on any guild corresponding to their session id[1]. - Enumerate server statistics and runtime information via the unauthenticated /stats endpoint (still public after the fix). [1] If on >=0.1.0, attackers are restricted to creating, controlling and deleting players created within their own session ID. Vulnerable Routes The following routes were entirely unauthenticated in >= 0.0.1, = 0.1.5. Server configuration (e.g. compose.yml): To restart the stack, run TypeScript client (0.1.5+): The client automatically handles authentication. Pass the password when constructing the client: Workarounds If upgrading is not immediately possible, restrict network access to the server's port using a firewall so it is only accessible from trusted internal IP addresses.

## Sources

- [GitHub Advisory GHSA-xv8g-fj9h-6gmv](https://github.com/advisories/GHSA-xv8g-fj9h-6gmv)
- [github.com](https://github.com/shi-gg/linkdave/security/advisories/GHSA-xv8g-fj9h-6gmv)
- [github.com](https://github.com/shi-gg/linkdave/commit/0f9a00d9d549b16278db81fce6dfec350c2abc01)

---
Source page: https://erroneo.us/security/ghsa/GHSA-xv8g-fj9h-6gmv/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt