CVE-2021-4236: Web Project Web

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not explicitly use WebSockets are not vulnerable.

Affected products

• Web Project Web: from 1.4.0, before 1.5.2 (fixed in 1.5.2)

Published 2022-12-27. Last modified 2026-06-17.