CVE-2026-48031

Name of the Vulnerable Software and Affected Versions go-base versions prior to 2026-05-18

Description The JWT signing secret is hardcoded to the string random in the dev.env template and as a programmatic fallback in the cmd/serve.go file. This allows an attacker to forge tokens for any user, including those with admin roles, resulting in a complete authentication bypass across all protected endpoints.

A previous attempt to mitigate this in auth/jwt/tokenauth.go was flawed because it only checked for the exact string random and replaced it with a non-persistent in-memory key. This caused a denial-of-service by invalidating all active tokens every time the application restarted.

Technical details include:

Recommendations Update go-base to version 2026-05-18 or later. As a temporary mitigation, manually set a strong, unique value for the AUTH JWT SECRET environment variable and ensure it is not set to random, secret, changeme, change-me, default, or left empty.