go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardc…

CVE-2026-48031 affects go-base, a Go RESTful API Boilerplate with JWT Authentication backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string 'random' in two locations: the dev.env template and a fallback in cmd/serve.go. This allows any attacker who reads the public repository to forge JWT tokens for arbitrary users, including admin roles, completely bypassing authentication on all protected endpoints. An attempted mitigation in auth/jwt/tokenauth.go only caught the exact string 'random', missing other weak secrets, and introduced a secondary denial-of-service issue by using a non-persisted in-memory key that invalidated all tokens on every restart. The vulnerability is particularly severe because the hardcoded secret is publicly known via the open-source repository. The issue has been fully patched in the 2026-05-18 release.