Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/dhax/go-base

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.1GoPublished

    Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery

    CVE-2026-48031 · GHSA-mqq6-462x-jxmm

    Affected
    • Go github.com/dhax/go-base < 0.0.0-20260517152733-cc82b9740fa6
    Fixed in
    0.0.0-20260517152733-cc82b9740fa6· Vendor fix available
    Issue
    Vulnerability: CWE-798 — Hardcoded JWT Secret + Broken Mitigation Affected Component - github.com/dhax/go-base — Go REST API boilerplate (go-chi/jwtauth/v5, Viper, PostgreSQL/Bun) - 1,685 stars on GitHub Vulnerability Locations | File | Line | Role | |------|------|------| | dev.env | 10 | AUTHJWTSECRET=random — template default shipped to all users | | cmd/serve.go | 35 | viper.SetDefault("authjwtsecret", "random") — code-level fallback | | auth/jwt/tokenauth.go | 22-25 | Weak mitigation: only checked literal "random", auto-generated non-persistent key | | auth/jwt/tokenauth.go | 28 | jwtauth.New("HS256", []byte(secret), nil) — creates JWT signer with the weak key | | pwdless/api.go | 203 | GenTokenPair() — issues access + refresh tokens signed with the weak key | Data Flow Description The JWT signing secret is hardcoded to the string "random" in two independent locations: 1. dev.env:10 — The template .env file sets AUTHJWTSECRET=random. Every developer who copies this template gets…

    Recommended action: Upgrade to 0.0.0-20260517152733-cc82b9740fa6 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →