CVE-2026-48031

go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin roles, and completely bypass authentication on all protected endpoints. This value is set in two places: the dev.env template (line 10) and a programmatic fallback in cmd/serve.go (line 35), so the application uses it even when no .env file is present. The original mitigation in auth/jwt/tokenauth.go (lines 22 to 25) only caught the exact string "random", letting other weak secrets through, and replaced it with an in-memory key that was not persisted, invalidating all tokens on every restart and effectively causing a denial-of-service. This issue has been fixed in version 2026-05-18.

• CWE-798

• https://github.com/dhax/go-base/commit/cc82b9740fa6b08e0fad409cd4b418e240dd0e00
• https://github.com/dhax/go-base/pull/31
• https://github.com/dhax/go-base/security/advisories/GHSA-mqq6-462x-jxmm
• https://github.com/dhax/go-base/security/advisories/GHSA-mqq6-462x-jxmm

Published

Aug 3, 2026

Last Modified

Aug 3, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48026lakeFS is an open-source tool that transforms object storage…8.7
• CVE-2026-48027Nx Console is the user interface for Nx & Lerna. On 19 May 2…9.8
• CVE-2026-48028Mastodon is a free, open-source social network server based …6.5
• CVE-2026-48029libheif is a HEIF and AVIF file format decoder and encoder. …7.1
• CVE-2026-4803The Royal Elementor Addons plugin for WordPress is vulnerabl…7.2
• CVE-2026-48030Pheditor is a single-file editor and file manager written in…9.9
• CVE-2026-48032Hulumi is an open-source toolkit that ships secure-by-defaul…8.3
• CVE-2026-48033Hulumi is an open-source toolkit that ships secure-by-defaul…8.4
• CVE-2026-48034Hulumi is an open-source toolkit that ships secure-by-defaul…8.5
• CVE-2026-48035Hulumi is an open-source toolkit that ships secure-by-defaul…7.1
• CVE-2026-48036Hulumi is an open-source toolkit that ships secure-by-defaul…8.4
• CVE-2026-48037Hulumi is an open-source toolkit that ships secure-by-defaul…6.3