A hardcoded JWT signing secret of "random" was embedded in the binary and the configuration template, enabling any user who could read the public repository to craft valid authentication tokens for any user, including administrators. This direct misuse of a weak secret satisfies CWE-798, allowing attackers to forge tokens and bypass all protected endpoints without needing legitimate credentials.

The vulnerability resides in the dhax:go-base Go REST API Boilerplate template. Versions released prior to 2026‑05‑18 are impacted because the secret appears in dev.env line 10 and a programmatic fallback in cmd/serve.go line 35. The fix was introduced in commit included in the 2026‑05‑18 release.

With a CVSS score of 9.1 the vulnerability is critically high. The EPSS score is not available, and it is not listed in CISA KEV, but the presence of a hardcoded, publicly known secret means exploitation is straightforward once the source code is accessed. An attacker merely needs to clone the repository or have visibility into the default configuration; they can impersonate any user by generating new JWTs signed with the known secret. The attack can be carried out remotely against the running service if it is configured to use the default secret, enabling full authentication bypass, privilege escalation, and potential data compromise.