Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery
Date: 2026-06
Affected: go/github.com/dhax/go-base
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-48031
CWE: CWE-798
CVSS: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

## Vulnerability: CWE-798 — Hardcoded JWT Secret + Broken Mitigation ### Affected Component - `github.com/dhax/go-base` — Go REST API boilerplate (go-chi/jwtauth/v5, Viper, PostgreSQL/Bun) - 1,685 stars on GitHub ### Vulnerability Locations | File | Line | Role | |------|------|------| | `dev.env` | 10 | `AUTH_JWT_SECRET=random` — template default shipped to all users | | `cmd/serve.go` | 35 | `viper.SetDefault("auth_jwt_secret", "random")` — code-level fallback | | `auth/jwt/tokenauth.go` | 22-25 | Weak mitigation: only checked literal `"random"`, auto-generated non-persistent key | | `auth/jwt/tokenauth.go` | 28 | `jwtauth.New("HS256", []byte(secret), nil)` — creates JWT signer with the weak key | | `pwdless/api.go` | 203 | `GenTokenPair()` — issues access + refresh tokens signed with the weak key | ### Data Flow ``` dev.env AUTH_JWT_SECRET=random OR cmd/serve.go viper.SetDefault("auth_jwt_secret", "random") │ ▼ auth/jwt/tokenauth.go: viper.GetString("auth_jwt_secret") │ ▼ auth/jwt/tokenauth.go: jwtauth.New("HS256", []byte(secret), nil) │ ▼ pwdless/api.go: GenTokenPair() → access + refresh tokens │ ▼ jwt/authenticator.go: Every authenticated request trusts the forged token ``` ### Description The JWT signing secret is hardcoded to the string `"random"` in **two independent locations**: 1. **`dev.env:10`** — The template `.env` file sets `AUTH_JWT_SECRET=random`. Every developer who copies this template gets the same default. 2. **`


Mitigations:

Architectural layers (MAESTRO):