CVE-2026-48031

go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...

CVE-2026-48031: Use of Hard-coded Credentials

go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...

GO-2026-5515 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery in github.com/dhax/go-base

Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery in github.com/dhax/go-base...

CVE-2026-48031

creationtimestamp| type| source ---|---|--- 2026-05-20 15:11:45+00:00| published-proof-of-concept| https://github.com/dhax/go-base/security/advisories/GHSA-mqq6-462x-jxmm 2026-08-03 19:54:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7bnbfowl2p...