9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48031

CVE-2026-48031: Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery

Vulnerability: CWE-798 — Hardcoded JWT Secret + Broken Mitigation

Affected Component

github.com/dhax/go-base — Go REST API boilerplate (go-chi/jwtauth/v5, Viper, PostgreSQL/Bun)
1,685 stars on GitHub

Vulnerability Locations

| File | Line | Role | |------|------|------| | dev.env | 10 | AUTH_JWT_SECRET=random — template default shipped to all users | | cmd/serve.go | 35 | viper.SetDefault("auth_jwt_secret", "random") — code-level fallback | | auth/jwt/tokenauth.go | 22-25 | Weak mitigation: only checked literal "random", auto-generated non-persistent key | | auth/jwt/tokenauth.go | 28 | jwtauth.New("HS256", []byte(secret), nil) — creates JWT signer with the weak key | | pwdless/api.go | 203 | GenTokenPair() — issues access + refresh tokens signed with the weak key |

Data Flow

dev.env AUTH_JWT_SECRET=random
  OR
cmd/serve.go viper.SetDefault("auth_jwt_secret", "random")
    │
    ▼
auth/jwt/tokenauth.go: viper.GetString("auth_jwt_secret")
    │
    ▼
auth/jwt/tokenauth.go: jwtauth.New("HS256", []byte(secret), nil)
    │
    ▼
pwdless/api.go: GenTokenPair() → access + refresh tokens
    │
    ▼
jwt/authenticator.go: Every authenticated request trusts the forged token

Description

The JWT signing secret is hardcoded to the string "random" in two independent locations:

dev.env:10 — The template .env file sets AUTH_JWT_SECRET=random. Every developer who copies this template gets the same default.
cmd/serve.go:35 — viper.SetDefault("auth_jwt_secret", "random") provides a programmatic fallback. Even if the .env file is missing entirely, the application silently starts with as the signing key.

Miggo Vulnerability Database

→

CVE-2026-48031

CVE-2026-48031:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/dhax/go-base	go	< 0.0.0-20260517152733-cc82b9740fa6	0.0.0-20260517152733-cc82b9740fa6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic CWE-798 (Use of Hard-coded Credentials) where the JWT signing secret is hardcoded to the predictable value "random". This insecure default is set in two places: the dev.env template file for developers and, more critically, as a programmatic fallback in the cmd.init function in cmd/serve.go using viper.SetDefault. This guarantees that if the AUTH_JWT_SECRET is not explicitly set, the application will silently start with the insecure key.

The jwt.NewTokenAuth function is responsible for creating the JWT signing service. In its vulnerable state, it would fetch this weak secret and use it to initialize the signer. An earlier, flawed mitigation attempt in this function was insufficient as it only checked for the literal string "random" and replaced it with a non-persistent, in-memory key, which was lost on restart.

An attacker who has read the public source code knows this default secret. They can then forge JWT tokens with arbitrary claims (e.g., granting themselves admin privileges) and send them to the API. The application's token verification middleware, configured by NewTokenAuth with the same weak key, will trust and validate these forged tokens, leading to a complete authentication bypass. The jwt.(*TokenAuth).GenTokenPair function is also implicated as it uses the compromised configuration to issue new tokens, perpetuating the vulnerability.

Vulnerable functions

cmd.init

cmd/serve.go

This initialization function sets a hardcoded default value "random" for the JWT secret via `viper.SetDefault`. If no secret is provided in the environment or configuration file, the application falls back to using this known, insecure secret. This allows an attacker with knowledge of the public source code to forge valid JWT tokens.

jwt.NewTokenAuth

auth/jwt/tokenauth.go

This function creates the JWT authentication service. It retrieves the JWT secret from the configuration, which could be the hardcoded value "random". The vulnerable version contained a flawed check that only replaced the exact string "random" with a non-persistent key, but otherwise used the provided secret without validation. This allowed the JWT signing key to be predictable, enabling token forgery. The patch adds strict validation against a list of known weak secrets and enforces a minimum length.

jwt.(*TokenAuth).GenTokenPair

auth/jwt/tokenauth.go

This function generates new access and refresh tokens using the JWT authentication service (`a.JwtAuth`) initialized by `NewTokenAuth`. Since `NewTokenAuth` configured the service with a weak, predictable key, any tokens generated by this function were also signed with that weak key. This function would appear in a runtime profile during user login or token refresh operations, where it would be using the compromised signing key.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

9.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-48031: Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery

Vulnerability: CWE-798 — Hardcoded JWT Secret + Broken Mitigation

Affected Component

Vulnerability Locations

Data Flow

Description

CVE-2026-48031:

9.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Basic Information

Basic Information

9.1

9.1

CVE-2026-48031: Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery

Vulnerability: CWE-798 — Hardcoded JWT Secret + Broken Mitigation

Affected Component

Vulnerability Locations

Data Flow

Description

Proof of Concept

Impact

Fix (PR #31)

Patched Versions

Resources

Credit

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI