goshs, a lightweight HTTP and SFTP server written in Go, contains a flaw that allows an attacker to bypass authentication by exploiting the documented empty‑username syntax. When the server is launched with the arguments -b ':pass' and -sftp, it accepts the configuration but installs no SFTP password handler, giving an unauthenticated user the ability to open an SFTP session and read or write any files on the server. This constitutes a severe authentication failure (CWE‑306) that can lead to the compromise of application data and potentially broader system control.

The vulnerability affects the patrickhener:goshs product in all releases prior to 2.0.0‑beta.6. The affected version information is explicitly limited to versions older than 2.0.0‑beta.6; no other vendor or product versions are listed.

The CVSS score of 9.8 indicates critical severity. The EPSS score is not available, but the lack of a KEV listing does not diminish the risk, as the vulnerability is readily exploitable over the network. Logically, an attacker can simply open an SFTP connection using the empty username syntax, achieving unauthenticated file access. Given the broad availability of the target and the lack of countermeasures, the likelihood of exploitation is high in environments where the service is exposed to the internet or untrusted networks.