A hardcoded JWT signing secret in the dhax go-base boilerplate allows attackers to forge administrative credentials and gain unauthorized system access.

The application utilizes a hardcoded string "random" as a fallback JWT signing secret when environment variables are missing. This allows unauthenticated attackers to generate valid JWTs, impersonate any user, and access protected API endpoints.

The ability to forge authentication tokens renders the entire security model of any application built on this boilerplate ineffective. With a 9.1 CVSS score, this vulnerability enables full unauthorized access to user data and administrative functions, posing a catastrophic risk to application security.

Immediate Action: Update to the latest version of go-base, which addresses the hardcoded secret and improves token security.

Proactive Monitoring: Audit all existing JWTs for signs of unauthorized generation or usage, and rotate any secrets that may have been exposed in environments using the vulnerable boilerplate.

Compensating Controls: Ensure that all production deployments use robust, unique, and environment-specific secrets that are not committed to version control systems.

Public Exploit Available: Unknown

This vulnerability is severe and stems from a fundamental security configuration flaw. All developers utilizing the go-base template must update their codebase immediately and ensure that all sensitive configuration parameters are properly isolated from the source code.