CVE-2026-48031
Received Received - Intake

Hard-Coded JWT Secret in go-base Boilerplate

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: GitHub, Inc.

Description
go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin roles, and completely bypass authentication on all protected endpoints. This value is set in two places: the dev.env template (line 10) and a programmatic fallback in cmd/serve.go (line 35), so the application uses it even when no .env file is present. The original mitigation in auth/jwt/tokenauth.go (lines 22 to 25) only caught the exact string "random", letting other weak secrets through, and replaced it with an in-memory key that was not persisted, invalidating all tokens on every restart and effectively causing a denial-of-service. This issue has been fixed in version 2026-05-18.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-04
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-48031
EUVD
EUVD-2026-52408

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-798 The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects go-base, a Go RESTful API template with JWT authentication. The JWT signing secret is hardcoded to the known string 'random', allowing attackers to forge authentication tokens for any user, including admin roles, and bypass authentication on protected endpoints.

Detection Guidance

Check if your go-base application uses the hardcoded JWT secret 'random' by inspecting dev.env or cmd/serve.go for the value. Search for 'random' in these files to confirm exposure.

Impact Analysis

An attacker could exploit this to impersonate any user, gain unauthorized access to sensitive data, perform administrative actions, or disrupt service by causing token invalidation on restart due to the weak secret fallback.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection (GDPR, HIPAA) due to unauthorized access risks, lack of proper authentication, and potential exposure of sensitive user data.

Mitigation Strategies

Upgrade to version 2026-05-18 or later. Replace the hardcoded secret with a strong, randomly generated value in dev.env and ensure it is persisted securely. Rotate all existing JWT tokens after updating the secret.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48031. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart