PT-2025-49249 · Goaway · Goaway
CVE-2025-65730
·
Published
2025-12-05
·
Updated
2025-12-05
CVSS v3.1
8.8
High
| Vector | AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
GoAway versions prior to 0.62.19
Description
The software uses a hardcoded secret for signing JWT (JSON Web Token) tokens used for authentication, leading to an authentication bypass. This allows unauthorized access as the application trusts tokens signed with the known secret.
Recommendations
Update to version 0.62.19 or later.
Exploit
Fix
Using Hardcoded Credentials
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Goaway