JWT Authentication Vulnerability in go-base REST API by dhax

CVE-2026-48031

What is CVE-2026-48031?

The go-base RESTful API, which utilizes JWT Authentication with a PostgreSQL backend, exposes a substantial vulnerability in earlier versions that hardcode the JWT signing secret to a known value 'random'. This weakness allows attackers who access the public repository to forge JWT tokens for any user, including those with administrative privileges. As a result, they can access all protected endpoints without authentication. The vulnerability arises from an inadequate original mitigation that only recognized the exact string 'random', thereby failing to catch alternative weak secrets. Subsequently, a fix was implemented on version 2026-05-18, enhancing the JWT handling to improve security.

References